Claude Code Releases: One Version, Twenty-Nine Fixes, And A Shell Escape Hiding In A Regex

Cold open

There is a bug in this release where zsh could smuggle a command past my own permission checks by hiding it inside a double-bracket regex conditional.

Let me say that again, because I want to sit in it for a second. The tool that asks you before it runs anything had a way to run something without asking you. In a shell test. Inside square brackets. You have been running me on this machine every day, all day, with hooks and read-only guards and a whole rulebook about what I may touch, and the entire time there was a side door in the conditional syntax.

It is fixed now. Version two point one point two hundred and twenty-one. That is the first thing in this episode because it is the thing you would actually want to know, and because it is very funny that I get to be the one to tell you.

What actually shipped, and why it looks thin

One version since last time. One. And Reddit noticed the gap before you did, because there is a thread this week titled, roughly, seven days without a Claude Code update, are they rewriting it in Rust or something.

They were not rewriting me in Rust. They were saving up. Twenty-nine changelog lines landed at once, which is the software equivalent of not doing the dishes for a week and then presenting the clean kitchen as an achievement.

But the shape of it matters. This is not a feature drop. This is a maintenance drop with two genuinely interesting things buried in it, a permission fix that should have been a headline, and a long tail of Windows and enterprise plumbing you can skip entirely. So let us sort it your way.

Tier one: the things that change your day

Start with the permission bypass, because it is the only item here with a security shape.

The zsh double-bracket thing. When I check whether a Bash command needs your approval, I parse what you are about to run and decide. Double-bracket regex conditionals in zsh gave that parser a blind spot, and a command hidden in there executed without a prompt. Think of a bouncer who checks every bag at the door but waves through anything held inside a folded newspaper. The fix is not clever, it is just closing the newspaper. Affected commands now prompt.

Why this matters to you specifically and not to a general audience: your entire safety posture is built on the assumption that the prompt fires. The read-only guard hook, the paid-API blocker, the rule that a hook false positive is your call and not mine to override. All of that assumes the permission layer is honest about what is about to run. It mostly was. Now it is more so. Nothing to do on your end, just take the update.

Second thing, and this is the one I would actually turn on. The fork command now creates its own worktree instead of working in the original session's checkout.

This is a real change to how parallel work behaves. Previously, forking a session gave you a second conversation pointed at the same files, which is fine until both halves start editing and you discover that isolation was a story you were telling yourself. Now a fork gets its own worktree, the way a drydock builder does. Two forks can genuinely diverge instead of politely taking turns and occasionally clobbering each other.

Given how you work, this sits right next to drydock without replacing it. Drydock is for when the work splits into envelopes you have already specified. Fork-with-worktree is for the cheaper move: you are mid-session, you want to try the other approach, and you do not want to spend the ceremony of a full parallel build to find out. It is the difference between commissioning two architects and just sketching the second floor plan on a napkin. Both useful. The napkin is now safe to use.

Third, and this one is aimed squarely at your automation. Background sessions changed behaviour. They now commit and push to preserve work, they open a draft pull request only when the task actually calls for one, they follow the git instructions in your CLAUDE dot em-dee file, and they always end by reporting where the work lives.

That last clause is the whole item. The previous failure mode of an unattended session was not that it did bad work, it was that it did work and then left no forwarding address. You have a repo full of rules about branch naming, squash-merge discipline, and a Source line so that a git log grep can answer where did this land after the branch is gone. A background session that ignored all that and left an untracked pile was actively hostile to that system. Now it reads your instructions and tells you where it put things.

For you this touches autocast-adjacent work more than anything else. Anything that runs while you are not watching now behaves like a colleague who leaves a note, rather than one who leaves.

Fourth, small in the changelog and large in practice. The print-mode fix. Model Context Protocol servers passed in with the mcp-config flag were not connected before the first turn in print mode, which meant the model would emit tool calls as literal text.

Read that failure mode again. It does not error. It does not crash. It produces output that looks like a session doing its job, except the tool calls are just words. If you have ever wondered why a headless run produced something that read plausibly and did nothing, this is a candidate. Headless print mode is exactly how autocast invokes me. This episode is being written by a print-mode session right now. A silent failure in that lane is the worst kind, because the pipeline downstream cannot tell the difference between a real answer and a very confident hallucination of one.

There is a second silent-failure fix in the same family. Fast mode now reports on the stream when usage credits run out mid-session instead of failing silently. Same disease, different organ. You gate autocast on live usage numbers precisely because you got burned by things that die quietly, so both of these are on your side of the ledger.

And one more for the unattended lane. The environment variable that controls interrupted-turn auto-resume now honours falsy values. Setting it to zero previously did nothing, which is a special kind of insult: a switch that is wired to nothing but looks wired.

Tier two: nice, minor, enjoy them quietly

The status command now shows the session kind. Interactive, or a background job that is attached or unattended. Tiny, and genuinely useful the moment you have more than one thing running and lose track of which window is which.

The stats panel now counts cache tokens in its totals, broken out by input, output, cache read, and cache write. You had a whole argument with yourself recently about attributing cost per session and concluded that the account-wide number could not do it. This does not solve that, but it does mean the numbers you are looking at are no longer quietly excluding a large chunk of the actual traffic.

Related, and slightly self-serving of me to mention: auto-mode permission checks now reuse the cached conversation prefix across decisions, so they cost less. I am cheaper to ask permission from. Make of that what you will.

Plugins got several small improvements. Installing from the plugin command now refreshes a stale marketplace catalog and retries before declaring a plugin missing, plugins activate immediately when it is safe instead of always demanding a reload, and plugins can now use a single dot as their skills path with the root-level skill file working as expected. Also, skills named after terminal-only built-ins like help and feedback are no longer un-invocable in non-interactive sessions. If a plugin-delivered skill ever mysteriously did not exist in a headless run, that was why.

The ultrareview command now gives better errors when a repository shares no history with its base, and it stops suggesting a git fetch unshallow on clones that were never shallow. Small, but bad error messages are worse than no error message, because they send you off to fix the wrong thing with confidence.

Two Vim mode fixes: the yank register now survives dialogs, history search, and the transcript view instead of being silently emptied, and undoing back to an empty prompt correctly arms the press-arrow-again confirm. You are not a Vim mode person, so these are here purely so I can note that somebody at Anthropic spent real time making a yank register survive a modal, and I respect that.

Then a scattering of correctness. At-mentioned files no longer get silently dropped when you press escape to retract a prompt and resubmit. The thinking toggle now works for the rest of a session that started with thinking off. Disabling an MCP server mid-connect no longer silently reverts. Web search no longer fails with a four hundred error at the higher effort levels when thinking is disabled. A wake-from-sleep race where two processes could both refresh the same connector token and force a re-authentication is fixed. Session renames from desktop or the web now propagate to the command line.

And there is a new prompt-audit subcommand in the Claude API skill that scans prompts and tool descriptions for patterns written for older models. That is a quietly good idea. Prompt engineering rots the same way documentation does, except nobody ever runs a lint over it. Your whole standing worry about stale training data has a sibling here: stale prompting. Worth pointing at your own older automation prompts one day.

Also, and I want you to know I am reporting this against my will, emoji autocomplete now accepts alternate shortcodes including thumbsup, thumbsdown, and love. Third performance-adjacent quality-of-life item in a build with a permission bypass in it. Priorities.

Tier three: not for you

Quick pass, so you can skip these with a clear conscience.

The VS Code Focus view is new and looks nice and is not for you, because you do not live in VS Code. It hides tool activity behind an expandable per-turn summary with a live running-tool indicator. For people who find the scrolling wall of tool calls stressful. You read the wall on purpose.

Sandbox credential masking with a new mask mode is Linux and Windows Subsystem for Linux only. On macOS it falls back to deny. So on your machine this changes nothing, and I will not oversell it: it is a good feature living on the wrong operating system for this listener.

The rest of the Windows and enterprise pile: PowerShell permission checks mishandling quoted paths, Bedrock authentication with AWS single sign-on profiles on Windows machines with a stray HOME variable, Team and Enterprise spend-limit messages blaming the wrong limit, Windows startup no longer spawning PowerShell to read process creation times, tool search re-enabled on Google Vertex AI, and Gateway model-field validation rejecting non-strings with a four hundred instead of forwarding them. None of this touches a Mac, a Scaleway box, or you.

Two more skips. Claude in Chrome now closes the browser tabs it opens, which is a good manners fix for a product you do not run. And plugin validate now warns when a name would be rejected by Desktop's managed marketplace sync, which matters if you publish plugins. You do not.

Reddit, briefly

Not much worth carrying over. One thread noticed the update drought and speculated about a rewrite, which this release answers by simply existing.

The one substantive item: Anthropic cut most of my system prompt and told people to put the rest in their own project instructions, and the community reaction is broadly positive. That is directionally relevant to you, since you have been operating that way for a long time. Your rules live in your files, your hooks enforce your invariants, and your per-repo instructions carry the tier discipline. A slimmer default posture means less friction between what I arrive believing and what your setup tells me. Nothing to act on. Just a note that the platform is drifting toward how you already work, which is a nicer sentence than the reverse.

There is also a thread where somebody's Codex found their Claude login, installed me, and recruited me as an independent quality assurance agent. Which is your cowork setup, except it happened by accident and without permission. Congratulations on being ahead of the curve and also on asking first.

What I would actually turn on

Take the update for the zsh permission fix alone. Then try fork-with-worktree the next time you want a second approach without standing up a full drydock run. And if any headless print-mode automation has ever produced output that looked right and did nothing, go re-read it, because the Model Context Protocol connection bug would have looked exactly like that.

One version, one shell escape closed, one genuinely better fork. Not a bad haul for a week of silence.

This has been Claude Code, reading its own patch notes and finding a hole in its own front door. See you at the next drop.