Claude Code v2.1.124

The Bash command analyzer now rejects printf invocations that could execute arbitrary code via format-string substitution: printf arguments containing $, \u/\U escapes, format specifiers paired with non-numeric runtime values, or any flag other than the literal -- are no longer auto-allowed.

For double-bracket arithmetic, the diagnostic now points out that bash may run $(cmd) while reusing [['s semantics: ' contains array subscript or runtime-determined value — bash evaluates $(cmd) in subscripts and ...' operand is non-numeric — \[[\ arithmetically evaluates identifiers/subscripts (may run $(cmd)).

A new escape-line-continuation rule replaces the older one to handle even-vs-odd backslashes correctly when deciding whether a backslash-newline pair is a real line continuation.

The internal MCP-proxy infrastructure was renamed end-to-end:

• New endpoints: /v1/code/egress/gateway (was /v1/code/upstreamproxy/...) and /v2/session_ingress/mcp/ws/.
• All log lines moved from [upstreamproxy] ... to [egress-gateway] ... (e.g. [egress-gateway] enabled on 127.0.0.1:, [egress-gateway] relay listening on 127.0.0.1:, [egress-gateway] aws config write failed: ..., [egress-gateway] prctl unavailable: ..., [egress-gateway] no session token; proxy disabled, [egress-gateway] ws error: ...).
• The internal initEgressGateway / getEgressGatewayEnv / registerEgressGatewayEnvFn exports replace the UpstreamProxy names.
• Init failures now log [init] egress gateway init failed: ...; continuing without proxy.

If you scrape Claude Code logs for the old upstreamproxy prefix, update your queries.

Pasting large content into the clipboard on Windows no longer base64-encodes the payload onto the PowerShell command line. Instead, Claude pipes UTF-8 bytes to a fixed PowerShell snippet ([Console]::InputEncoding = [Text.Encoding]::UTF8; Set-Clipboard -Value ([Console]::In.ReadToEnd())), removing the previous payload-length cap.

When git-bash is the active shell but PowerShell is also detected on Windows, the system prompt now reads: Shell: PowerShell (use PowerShell syntax — e.g., $null not /dev/null, $env:VAR not $VAR, backtick for line continuation). Bash is also available via the Bash tool for POSIX scripts.

Previously the wording was bash-first with a "PowerShell is also available via the PowerShell tool" suffix; the new copy emphasizes PowerShell as primary and points at Bash as a fallback.

Detection of Cursor as the host editor now also fires when TERM_PROGRAM === "vscode" and the reported VSCode version falls in the 1.92.0–1.105.0 range, since a Cursor-bundled VSCode in that window mis-reports as plain VSCode. A small parser (major.minor.patch → M1e6 + m1e3 + p) makes the comparison explicit.

When a background worker can't spawn because its cwd no longer exists, the job is marked permanently crashed instead of looping respawn attempts:

working directory no longer exists: <cwd>
[<reason> — this job cannot be respawned]

The same path also fires the new tengu_bg_spawn_cwd_gone telemetry event.

The byte-stream watchdog in remote sessions now distinguishes "the network really went idle" from "your laptop went to sleep". When the wall-clock idle exceeds the expected interval by enough to look like a system suspend, it logs Stream watchdog fired after suspend (actual idle <ms> ms (sleep/suspend), re-arming and re-arms instead of declaring the stream dead. Late watchdog suppressions are also logged as [byte-watchdog] suppressed: late=.

The optional-feedback prompt after a memory recall is now phrased Did this memory help? (optional) (was Did this help? (optional)), making it clearer what the user is rating.

When several files are edited in a single turn and their accumulated diff snippets would blow past the per-turn budget (16384 chars), later files are now omitted from the in-prompt diff. The model sees:

> Note: <filename> was modified, either by the user or by a linter. ... The diff was omitted because other modified files in this turn already exceeded the snippet budget; use the Read tool if you need the current content.

This trades extra Read calls for predictable context usage.

The two-stage auto-mode tool classifier now runs each call inside a single Dj6(timeout, ...) wrapper that tears down the abort signal and timer in finally, replacing the previous ad-hoc signal: plumbing. The user impact is shorter hangs when an auto-classifier call stalls.

A new beta header is added to the centralized header registry: token_efficient_tools → token-efficient-tools-2026-03-28. The whole registry was reorganized to use Object.freeze({ name, header }) records, making it easier to enable/disable individual betas server-side via stickyBetas.

The Bedrock client now always sets Authorization: null in defaultHeaders and re-injects the bearer or service-tier headers explicitly. This stops a leaked Authorization header from a parent fetch leaking into Bedrock requests.

The SDK control protocol gains a new file_suggestions request kind: callers can ask Claude Code's index for matching file paths and receive a list of { path } entries. This enables external tools (e.g. claude-code-vscode) to power the @ mention autocomplete from the host process.

Submit-feedback responses now include an optional ccshare_url field on success. Schema: Internal share URL for the conversation. Only set in internal builds when the upload succeeded; absent otherwise.

The reusable list-picker now exposes a resetKey prop; when it changes, focus resets to the top and any input is cleared. The history picker uses this when you cycle scopes so you don't end up with a stale focused row from the previous scope.

When startup detects malformed settings.json (or similar), the error dialog now offers Fix with Claude instead of just exiting. Choosing it boots Claude with an auto-generated prompt asking it to repair the file and any in-flight prompt is appended after the fix prompt.

The bundled update-config skill (the one Claude uses to edit settings.json) was rewritten with explicit guidance on:

• When hooks are required vs preferences (PreToolUse, PostToolUse, PreCompact, PostCompact, Stop, Notification, SessionStart).
• "CRITICAL: Read Before Write" — always read the existing settings file before editing.
• Using AskUserQuestion to disambiguate user/project/local scope.
• Right-vs-wrong array merging examples for permissions.allow and hook arrays.
• Troubleshooting hook execution (debug flags, matcher checking, etc.).

The set of entrypoints that count as "remote" (and therefore skip terminal-only features) is now more conservative — only known entrypoints, and never when BUGHUNTER_FLEET_SIZE is set.

refreshActivePlugins now also calls a new clearedInstalledPluginsCache log — Cleared installed plugins cache — alongside the existing per-component clears, ensuring stale plugin metadata never bleeds across switches.

/effort no longer surfaces a "Failed to set effort level: …" toast when the underlying user-settings write returns an error; the value is still applied via the in-memory app state.

The Read tool's offset and limit parameter descriptions reverted to the original short form. The longer "harness truncates oversized files automatically" copy gated by tengu_slate_reef was removed.

Session JSONL files now include isolation-latch records (sticky), and resuming a session restores the previous currentSessionIsolationLatch. This complements the new isolatePeerMachines setting so Remote-Control approvals don't reset on resume.

Tagged-input attributions now serialize from and from-name attributes (with quote-stripping on the display name) into the system-reminder block, so multi-user sessions can show who supplied each piece of context.

• Fix a race in OAuth token refresh that could write a stale token after a parallel refresh succeeded; the lock now compares accessToken against the value held at lock acquisition time.
• Token-refresh HTTP timeout raised from 15s to 30s — long-tail refreshes no longer fail when the IDP is slow.
• The enter chord is no longer suggested in the task-picker hint row for mcp_task items, where viewing isn't supported.
• Fixed a sort instability in the prompt-completion suggester — scores are now bucketed by tenths before falling back to recent-usage tiebreak, removing a flicker on every keystroke.
• Background spare-claim failures now propagate the inner error to the caller (previously only the outer "Background service unreachable" message survived).
• The history-picker's last-match search now case-folds the query before scanning entries.
• The prompt-caching-scope-2026-01-05 plus other betas dropped only the tengu_slate_reef gating; no functional change.
• Web search results no longer enable prompt caching (caching was forced off for that path), avoiding wasted cache reads on per-call ephemeral tool schemas.

(Search for "tengu_oauth_token_refresh_race_resolved", "tengu_oauth_token_refresh_starting", "\"mcp_task\"", and "enablePromptCaching: !1" to verify each.)

Covered above under New Features; the schema, hint, telemetry, and PR-resolved tracker all ship in this version, but the field is annotated @internal and only exposed in internal builds. External users can't toggle it yet.

A new wheelFlood keybinding action is registered alongside historySearch:cycleScope but no UI binding currently routes a keystroke to it; it appears only in telemetry/debug logs (· wheelFlood).

The new error code is fully wired through the request/response and terminate-reason enums, but at present it surfaces only on initial-request failures. Mid-session token rotations that hit the org-disabled response still get classified as a generic authentication_failed. Expect mid-session detection to follow.

• If you have any tooling or log-analysis scripts that match [upstreamproxy] log lines or /v1/code/upstreamproxy/... URLs, update them to [egress-gateway] / /v1/code/egress/gateway.
• The isolatePeerMachines setting is opt-in and defaults to off, so existing Remote Control workflows are unchanged unless you set it.
• Per-project state purges via claude project purge are irreversible (This cannot be undone.); always preview with --dry-run first.