A sweeping stability pass hardens session resume, retries, streaming, permissions, plugins and terminal UI, while adding safer MCP validation and Bedrock gateway controls.
desktop policy blocks, including blockReadsOutsideWorkingDirectories and disableBypassPermissionsModeassume_role on Claude apps gateway Bedrock upstreams: the gateway calls Bedrock as an IAM role it assumes through STS, in another AWS account if needed, optionally one session per developerguardrail: {id, version} on Claude apps gateway Bedrock upstreams to apply an Amazon Bedrock guardrail to every request sent through them (set it on all Bedrock upstreams or none)telemetry.resource_attributes to the Claude apps gateway config, to put fixed labels on the telemetry of Claude Desktop and /login sessions"attribution": false in settings.json to hide all commit and PR attribution; older CLI versions skip a settings file that holds it, so keep the object form in files shared across versionsclaude plugin validate: it reports .mcp.json entries that would be silently dropped at load, undeclared ${user_config.*} references, and insecure URLs/insights that estimates how many permission prompts auto mode could have handled in your recent sessions/skills, /mcp and /plugin Installed lists in fullscreen mode, like the one /workflows now has: it appears while the mouse is over the list and can be clicked or draggedsandbox.network.allowLocalBinding--agents to accept the path to a JSON file (with -p) as well as inline JSON, and to allow an empty prompt/batch to run where a WorktreeCreate hook provides the agent worktrees, not only inside a git repositoryclaude plugin validate warning when a shell-form hook leaves ${CLAUDE_PLUGIN_ROOT} unquoted (it breaks on plugin paths with spaces)/ menu, /skills, /context and the /plugin Installed list to show skills synced from claude.ai by their short name when no other command uses it, not anthropic-skills:<name>/deep-research reliability on long research briefs by removing unused required fields from the scope step's outputenv variables ignored because the session's launch environment already sets them/permissions and /usage: ↑/↓ move focus between the tab row and the content, and a list responds to keys only while it has focus/help and /sandbox: ←/→ and Tab switch tabs from inside a tab's list, and ↓ on an empty Custom commands tab in /help no longer leaves the keys stuck until Esc/install-github-app, /desktop, the /permissions auto mode environment prompts, and the /plugin "Add marketplace?" and "Run this command?" prompts: they now use the standard dialog frame with key hints, and Ctrl+C or Ctrl+D cancels them on the second press like other dialogs/workflows and /mcp lists: they page (PgUp/PgDn, Home/End) and take j/k and the mouse like other lists, their arrows follow select:previous/select:next rebinds, and x in /workflows stops the run the pointer is on/plugin plugin and marketplace details menus and the /remote-control already-connected menu: they now support Home/End and clicking a row/skills: each row now leads with the skill's name, with ✔ or ◯ alone showing on or off, and stays on one line in narrow terminals/skills, /workflows, /feedback): a name keeps 20 columns beside its first detail, and details are shown whole or not at all/diff: a scrollbar shows where you are in a long list of changed files, and long paths no longer wrap their rows/hooks: a hook's detail screen now says what kind of hook it is and where to change it, instead of always pointing at settings.json, and the hooks-disabled, safe mode and managed-hooks-only notices each say what is happening in one plain sentence/mcp: a disabled server is read as "off" instead of "pending"--max-turns, when the model alternated unparseable tool calls and output-limit truncationCLAUDE_CODE_RETRY_WATCHDOG sessions failing on the first 5xx or dropped connection after a run of 429/529 waits, and sleeping uncapped and silently on a long Retry-After from a 5xxRetry-After: 0--input-format stream-json sessions (Agent SDK, VS Code extension) and scheduled cloud sessions failing every turn with an error when an earlier assistant message had plain-string content-p, Agent SDK) failing on the next turn after the directory they were started in was deleted mid-session/.vol, /.nofollow or /.resolve (which can reach a network mount) before approvalrm whose target is only command-substitution output, such as rm -rf "$(pwd)", running unprompted in auto and --dangerously-skip-permissions mode; it now asks even with a Bash allow rule, unless run with CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1excludedCommands entries not matching git rev-parse --git-dir, programs named like shell builtins, and commit messages containing [WIP] or # lines$TMPDIR when CLAUDE_CODE_TMPDIR is setclaude --bg starting a background session, and running its project hooks, in a directory that had not passed the workspace trust prompt; it now asks for trust first, or exits when not run interactively--setting-sources (and SDK settingSources) not being forwarded to spawned sessions: teammates, /bg, claude agents sessions and --worktree --tmux now start with the parent's restriction--add-dir directory inside the working directory being sent to the model twice in headless and SDK sessions/loop wakeups being fired again every second when their delivery failed, which could make Claude Code exit at the end of a turnclaude remote-control starts for you to open from Claude Desktop, claude.ai or the mobile appgcpAuthRefresh/awsAuthRefresh login processes being left running (and holding their localhost callback port on Windows) when Claude Code exits or the refresh times outmcp_tool hooks on blocking events (PreToolUse and similar) being skipped while their MCP server was still connecting; they now wait for it, up to the MCP connect timeoutMCP_CONNECTION_NONBLOCKING=0 giving up on claude.ai connectors after 1s instead of honoring MCP_CONNECT_TIMEOUT_MS--channels plugin entries being checked against the installed plugin's marketplace alone; the installed plugin's name must now match the entry as well--plugin-dir on a folder of plugins that also has a .claude-plugin/marketplace.json loading one empty plugin instead of the plugins in itclaude plugin uninstall refusing to remove a project-scope plugin that isn't enabled, saying it is "enabled at project scope" while claude plugin disable says it is already disabledclaude plugin update failing for project-scoped plugins when --scope is omitted — it now resolves the scope the plugin is installed at instead of assuming userclaude plugin validate reporting privacyPolicyUrl, supportUrl and other listing metadata keys in plugin.json as unknown fieldsknown_marketplaces.json recording a marketplace as refreshed when its remote could not be reached and CLAUDE_CODE_PLUGIN_KEEP_MARKETPLACE_ON_FAILURE kept the existing clone/plugin Errors tab showing no confirmation after its last error is resolved/plugin starting a second uninstall or update of the same plugin when Enter was pressed again while the first was still runningy held while /plugin checks a marketplace source adding the marketplace the instant the "Add marketplace?" question appears, before it can be read1 answering Yes in /permissions' delete and remove-directory confirms while the pointer is on No, which let a held 1 remove one workspace directory after another/config offering to turn thinking off on models that can't; thinking now stays on there, with a one-line reason in place of the switch/context total leaving out messages added since the last response; it now matches its categories and can read higher than the status line/model showing the raw API error JSON and request ID when the API refuses the picked model; it now shows the server's message and says the model was not changed/ide showing "No available IDEs detected" while also listing a running IDE/setup-bedrock or /setup-vertex restarts Claude Code to apply new settings/config exiting when respectGitignore or copyFullResponse in ~/.claude.json holds null/memory, /hooks, /mcp (including a server's sign-in screen), /export, /copy, /theme, and /teleport's uncommitted-changes and login prompts (where Esc also quit)x or s, acting on the previous selection: a stale effort level in /effort and the model picker, and the previously highlighted row in /skills, the background task rows under the prompt, MCP server prompts and /install-github-app/install-github-app updating the workflow after "Skip workflow update" was chosen, running setup twice on a repeated Enter, and ↑ on the repository step blocking a typed repository name when no repository was detecteddj/dk/dG/dgg and their c/y forms acting on part of a line; 1G going to the last line; d0/c0/y0 doing nothing; the cursor being off by one after . repeats an insert; and o/p on a !-prefixed line switching to shell modecw on a space, an empty line, a word's last letter or a one-letter word also changing the next word; word motions stopping inside words in Hindi, Bengali and other scripts; and ., p or P that inserts text starting with ! switching to shell mode, losing text or editing the wrong character- 316.) showing as letters, roman numerals or the wrong numberskeybindings.json, and showing a stray · when the stop-all-agents shortcut is unbound/skills) in fullscreen mode/heapdump summary saying most memory is native when it is in the JS heap snapshotx stopping it, when a new run started while the list was open/config, /plugin, /permissions) showing no highlight while the tab bar has focus when color is off (NO_COLOR)/plugin Installed list scrolling the pane behind it instead of the list/hooks and /mcp detail views printing a long value over the row below it in narrow terminals/plugin not being answerable by typing a number in screen-reader mode$TMPDIR/… failing with "Permission denied"claude.exe backup, which could leave no claude.exe behindCLAUDE_CODE_AUTO_MODE_SERVER to also apply on a direct Anthropic API connection: 0 opts out of the server-side auto mode classifier (the local classifier then counts toward usage), 1 opts inrm prompt in --dangerously-skip-permissions and auto mode to wait 2 minutes for an answer, then deny the command with a rewrite hint so unattended sessions keep going (CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT=1 turns this off)managedMcpServers entry's envHelper path starts with \??\ or /??/, a path form current Claude Desktop refuses to runcommand hook that appends --system-prompt or --append-system-prompt must switch to --system-prompt-file or --append-system-prompt-file⧉ name or ⧉ N) that opens /artifacts, which now lists this session's artifacts first/config, to tint the row instead of drawing a second ❯ pointer beside the focused row'sclaude plugin uninstall --json and the /plugin dialog to say a plugin's data was kept when its folder stays because another installed plugin uses it or install records cannot be read/tasks): pressing x on a running /ultrareview now asks for confirmation before stopping the review/agents entry from the command menu and /help; typing /agents still explains where the wizard went