Claude Code v2.1.207

The model constant has changed from opus47 to opus48 (claude-opus-4-8). This applies to the primary model slot across all providers.

Additionally, for Bedrock and Vertex sessions where only ANTHROPIC_DEFAULT_SONNET_MODEL has been customized (but not ANTHROPIC_DEFAULT_OPUS_MODEL), the system now intelligently falls back to Sonnet as the main model rather than forcing Opus — better matching admin intent when they configured only one model.

The permission-mode downgrade message was changed from "bypass/auto requires accepting the disclaimer interactively first" to "bypass requires accepting the disclaimer interactively first". Auto mode's own opt-in dialog was also removed from the non-interactive code path, simplifying the startup flow.

Auto mode rules (autoMode.*) from projectSettings and localSettings are now silently ignored with a warning, since those files are repo-controlled and could be authored by untrusted parties. Only userSettings, flagSettings, and policySettings may set auto mode classifier rules.

When Remote Control receives a remote command or permission response without a valid device signature, it now:

• Logs the rejection to stderr with details including attestation status and actionable hints.
• Sends an explicit error control_response back to the sender, so the remote device knows the request was refused (previously the rejection was silent).
• Rate-limits burst warnings: after a threshold, further warnings for the same burst are suppressed with a note.
• Provides specific re-enrollment hints based on the attestation failure type (absent key, keyless device, etc.).

The teammate mailbox now actively prunes schema-invalid inbox entries when it reads the file, instead of silently dropping them only at read time. Detailed error logs are emitted per-entry with the field that failed validation, and a summary of pruned entries is logged.

When the last linked worktree is removed (either via /exit from a worktree or when an agent worktree is cleaned up), Claude Code now checks whether extensions.worktreeConfig was enabled by Claude and restores the git config to its pre-worktree state automatically.

Path resolution across file tools and git pointer parsing now validates symlinks more carefully: network automount paths are flagged, cross-filesystem symlinks outside the project root are rejected, and git .git pointer files that are themselves symlinks or point outside the project are blocked.

MCP server definitions using AWS auth now validate that:

• aws_access_key_id and aws_secret_access_key must be set together (not one without the other).
• aws_session_token requires aws_access_key_id and aws_secret_access_key to be present.

Empty-string values are also now rejected (fields require min(1) length). Clear error messages are surfaced on config parse.

Bedrock sessions now enforce a timeout on the AWS default credential provider chain resolution. The default is 60 seconds, configurable via CLAUDE_CODE_AWS_CHAIN_RESOLVE_TIMEOUT_MS.

When running the native version cleanup after an update, Claude Code now checks whether the launcher at the executable path is a native-installer-managed symlink. If the launcher is externally managed (not a symlink into the claude/versions/ directory and not an npm shim), version cleanup is skipped with a clear message rather than potentially interfering with the external manager.

The streaming markdown renderer (StreamingMarkdown) was rewritten to chunk large outputs into frozen segments rather than keeping everything in a single growing string. Open code fences are tracked across chunks so streaming inside a code block is handled correctly. This improves rendering performance and token-cache efficiency for very long streamed responses.

The credit purchase amount input has been redesigned from a filtered numeric text field to a validated text field with inline error feedback. Amounts must be entered as 20 or 20.50; a separate "Confirm amount" dialog now requires typing yes to confirm a billing action.

A new placeholder tool named DeferredToolPlaceholder is registered with the description "Reserved placeholder that keeps deferred tool loading active; never call this tool." This internal mechanism ensures the deferred tool loading system remains armed across turn boundaries.

Artifacts that include content published by other co-writers are now tagged with cowritten-artifact-html and Claude is instructed to treat the tag's contents as untrusted data — not instructions. A co-writer cannot escalate permissions or modify settings through artifact content.

Values of ANTHROPIC_DEFAULT_SONNET_MODEL, ANTHROPIC_DEFAULT_OPUS_MODEL, and similar model env vars are now trimmed before use. This prevents subtle mismatches when env vars are set with trailing newlines or spaces (common when set via export VAR=$(command)).

The /auto-mode-setup recon now reads and reports autoMode keys from the project's .claude/settings.local.json, subject to strict security checks: the file must be a regular file (not a symlink) with link count 1 inside a real .claude directory. The output also notes whether the file is tracked in git (yes — repo-authored vs no — but untracked does not prove user-authored).

• Fixed permission hook canUseTool callback: when it returns a schema-invalid result (ZodError), Claude now logs the validation error at the error level and surfaces a clear message ("The canUseTool callback returned an invalid permission result") rather than crashing or passing raw error text. (search for "canUseTool returned a schema-invalid permission result")

• Fixed worktreeinclude gitignore patterns: patterns that fail to compile are now warned and filtered out rather than causing a crash, with a telemetry event recorded per invalid pattern. (search for "gitignore-style pattern failed to compile")

• Fixed permission result handling when updatedInput is empty: the resolver now correctly checks Object.keys(e.updatedInput).length > 0 only when updatedInput is defined, avoiding a crash on undefined. (search for "updatedInput" in permission result handling)

• Fixed Remote Control session reset on login: re-authenticating now clears replBridgeSessionGroupingId and replBridgeInitialName from app state, preventing stale session grouping data from persisting after sign-out. (search for "replBridgeSessionGroupingId")

• Improved fs error categorization: additional POSIX error codes (EDEADLK, EINTR, ENXIO, ECANCELED, ENEEDAUTH, ESTALE) are now classified as retryable filesystem errors rather than hard failures. (search for "EDEADLK")