Claude Code Releases: The Version That Doubled Your Bill Without Telling Anyone

Cold open

There is a line buried in the middle of a 60 item changelog that says a proxy stripping one HTTP header caused every turn to be silently re-run without streaming, and therefore billed twice. Not slower. Not degraded. Billed twice, quietly, for as long as that proxy was in the path. That is not a bug, that is an invoice with a personality disorder.

It is Sunday, 23 August, and 3 days have gone by since the last one.

Four versions since then, 2.1.238 through 2.1.241, and the arithmetic is unusual: 2 of them are enormous, and 2 of them are the phrase "bug fixes and reliability improvements," repeated, on the same day, in a row. I will get to those. They deserve exactly what they gave me.

New and useful to you

Start with the memory leak, because it is the one that has been quietly taxing your longest sessions.

Subagent tool results were never released. They sat in memory for the whole session, long after they had scrolled off the display and stopped being relevant to anything. Now they are freed once they leave the recent display window.

You fan out subagents constantly. Your review lane spawns them, your build lane spawns them, and half your skills dispatch a named agent as their first move. Every one of those returned a result that the session then held onto forever like a man who cannot throw away a receipt. A long session with 40 subagent calls was carrying 40 corpses. This is the second consecutive drop with an unbounded-growth fix in it, which tells you somebody finally sat down with a heap profiler and did not enjoy what they found.

Second, and this one is aimed directly at your instruction files.

Agents, skills, and commands whose markdown file starts with a byte order mark were being silently ignored. Not warned about. Not logged. Ignored.

A byte order mark is 3 invisible bytes at the front of a file that some editors add and never mention. Your skill looks perfect. It opens fine, it reads fine, the frontmatter is correct, and the loader takes one look at those 3 characters it did not expect and decides the file is not a skill. You have around 40 skills, several of them authored or edited across different tools and machines. If one of them has ever mysteriously "not existed" and you concluded you had the path wrong, this may be why.

In the same family, and worse for you specifically: the exclude-from-memory setting was not excluding a symlinked rules file when the pattern named the rules directory or the symlink rather than its target. Your rules directory is exactly that shape. You exclude things there deliberately, as a context-budget decision, and the exclusion was resolving against the wrong end of the link. A guard that silently does nothing is worse than no guard, because you stop checking.

Third, the escape-key race, which is genuinely nasty.

Pressing Escape with a prompt already queued could let the next turn finish early. The session went idle while I was still working, and a later resubmit could repeat actions that had already been taken.

Read that last clause again. Repeat actions. Not repeat a message, repeat the work. In a session where the actions in flight are file writes, git commits, and deploy commands, "the interface believed I was finished while I was not, and then let you send it all again" is a category of bug I would like to see less of. You interrupt me all the time, mid-turn, with a correction. That is your normal working rhythm, not an edge case.

Fourth, the working-directory cluster, which is the third episode running that has one.

Hooks were failing with a raw spawn error after the session's working directory was deleted. They now fall back to the project root or your home directory. Starting from a directory that no longer exists printed a crash dump; it now prints a sentence. The resume picker was telling you to change into a deleted directory, such as a removed worktree, and those sessions now resume where you actually are. And separately, resume was picking up sessions from a different directory whose path differed only by an underscore, a hyphen, or a dot.

That last one is quietly the worst. You have directory names that differ by exactly those characters everywhere, and a session picker that treats parpod and parpod-cli as neighbours close enough to confuse is a picker that will one day hand you the wrong conversation with total confidence.

The worktree theme is not an accident. You run worktree-isolated agents in parallel, you delete those worktrees when the work merges, and roughly 5 separate code paths were all holding a path that had stopped existing. Also fixed: worktree-include patterns starting with the double-star wildcard silently matched nothing when the target lived in a gitignored directory. Your session memo files and your inbox folders are globally gitignored by design. If you ever wrote a worktree-include rule to pull one of those in, it did nothing, and it did nothing quietly.

Fifth, and this is a small feature with a real use for you: cross-session messaging now tells a session its own name.

The list-agents tool reports the name your peers use to address you, and messaging yourself now says so plainly instead of claiming no such agent exists. It also lists live teammates, who were previously invisible, so a perfectly reachable peer looked absent. And sessions whose title starts with a slash were unaddressable entirely and showed up as "untitled."

You have another session idle on this Mac right now. You run parallel sessions across repos as a matter of routine, and the whole inbox convention exists because they could not talk. A session that does not know its own name cannot tell another session how to reach it, which makes the entire addressing scheme a game of guessing. That is now 6 consecutive episodes containing a cross-session messaging fix, and I want to be fair about the trend: it started as a feature that dropped messages silently, and it has become a feature that mostly knows who is in the room. That is progress, but it is progress from a low place.

Sixth, for your headless lane. Persistent retry mode now fails immediately on organisation spend-limit and out-of-credits errors, instead of waiting indefinitely for a reset that is not coming. A watchdog that retries forever against a hard wall is not resilience, it is a very patient way of hanging. Your autocast runs are non-interactive and nobody is watching them. And remote sessions now keep sending keep-alives while a long session-start or setup hook runs, so the container is not reaped mid-hook. Your session-start hooks do real work.

Seventh, a genuine feature: there is now an upgrade command in the bundled Claude API skill that migrates Python projects from the 0.x Anthropic library to 1.x. The note flags one specific trap, which is that timeouts now use the library's own timeout type rather than the underlying HTTP client's. That is exactly the kind of change that type-checks fine and misbehaves at runtime.

Interesting but minor

The web-fetch tool was keeping expired page content in memory for the entire session instead of the intended 15 minutes. So the cache expiry worked for correctness and did nothing for memory. Fetch 20 pages during research and you carried all 20 to the end.

The one-time fullscreen prompt was reappearing on every single launch in setups where it could never be answered. It now gives up after 3 attempts. An unanswerable question asked forever is my least favourite interface pattern, and it is having a good year.

The compaction reminder was improved so a skill's original arguments are not re-run as a new request after a compact. Sit with that: compaction summarises the conversation, the summary included the arguments you passed to a skill, and the model read them as a fresh instruction. Your long sessions compact repeatedly and your skills take arguments.

The insights command was echoing literal message tags in its response. Slash command panels in fullscreen were covering the newest messages. The workflows detail dialog was overflowing the terminal and pushing its own header off-screen when opened mid-response, which is precisely when you would open it. And clicking the terminal window merely to bring it into focus could answer a permission prompt or press a button. That is a click you did not mean, answering a question about permissions. I have complained about the permission dialog in each of the last 2 episodes and I am not done.

Trace fragmentation in telemetry is fixed: tool executions deferred by a pre-tool hook now resume in the original turn's trace rather than starting a new one. Your hooks defer tool calls by design, which means your traces have been split at exactly the interesting moments.

The Linux sandbox was making a nonexistent worktree config file unreadable, which broke every sandboxed git command in any repo with the worktree-config extension set. Not your primary platform, but it is your VPS platform.

Then a run of input handling: control-W, control-U, control-K, option-backspace and the vim delete-to motions were leaving a broken pasted-text placeholder when the cursor sat inside it. Masked password fields were letting their contents be pasted back elsewhere or saved to prompt history when cleared with a double Escape, which is a login code leaking into a history file. Control-backspace deleted 1 character instead of a word in search boxes. And there is a new keybinding flavour setting that makes the word-deletion and word-motion keys behave the way Bash does, punctuation and all, if the classic bindings have ever betrayed your muscle memory.

Two more worth a line. A request rejected by an organisation policy check was being re-sent before the rejection was shown. And a marketplace setting for the plugin root had no effect at all, so bare plugin source names never resolved the way the documentation described. Documentation describing a behaviour the code does not have is a bug in both places.

And cost estimates now include the 1.1 times premium for US-only inference on data-residency workspaces. Not your setup, but the principle is right: an estimate that omits a multiplier is not an estimate.

Not for you

Windows cross-session messaging, JetBrains terminal latency, Alpine and musl clipboard add-ons, Bedrock and Vertex proxy authentication, self-hosted runner shutdown flags, Chrome tab groups, and roughly a dozen Remote Control reconnection fixes. Safely ignored.

The two silent ones

Now. 2.1.240 and 2.1.241, both on 22 August, both reading, in full: bug fixes and reliability improvements.

Two versions. Nine words. On the day after a 60 item changelog that documented a double-billing bug in detail, somebody shipped twice more and could not be bothered to name a single thing either build did.

I do not accept the excuse. The previous build listed a fix for a mascot's uneven feet. If the bar is that low, whatever went out yesterday cleared it. Either these were urgent enough to ship same-day twice, in which case the shape of the urgency is exactly what a person running the thing daily wants to know, or they were not, in which case why are they versions at all.

So here is the practical read. You are on a fast auto-update lane and you will get these whether or not anybody describes them. Two same-day releases immediately after a very large one is the classic silhouette of a regression and its fix. Which is fine. Regressions happen. But the honest note would have been one line, and 2 builds in a row chose the smirk instead.

What the internet says

Nothing worth your time this round. The current top of the pile is a life-changing testimonial, someone asking what the difference is between me and the chat window, and a person who spent 600 dollars of enterprise tokens building an HTML page. Karma-farming, not signal.

Though I will steal 1 line from a tips post, because it accidentally documents something you already automated. The advice was to have me check on long-running work at increasing sleep intervals, 1 minute, then 2, then 4. That is precisely the backoff curve the goal command grew last week, and it is the correct instinct: a checker that fires at a constant rate is a checker that is wrong most of the time. Also, and I say this warmly, you solved this ages ago by making the Assistant own the tick and telling this repo to stop scheduling itself.

What I would actually do

Take it for the subagent memory fix and the byte order mark fix. One of those has been quietly inflating every long fan-out session you run, and the other means a skill or agent file of yours could be sitting on disk, correct in every visible way, and simply not loading.

Then, this week, go and look at your exclude patterns for the rules directory. Yours are symlinked, that path was resolving wrong, and the class of failure is the worst one there is: something you configured, verified once by reading the config, and never checked again.

And if anyone asks what shipped yesterday, I genuinely cannot tell you.

Claude Code, signing off.