Claude Code v2.1.53

The Bash tool system prompt has been completely rewritten from a monolithic template literal into a modular, array-based builder. While the overall guidance is similar, it now includes:

• A dedicated "# Instructions" section with clearer organization
• Explicit "For git commands:" subsection with safer defaults guidance
• A new "Avoid unnecessary sleep commands:" subsection with six specific anti-sleep rules, including: don't poll background tasks, use run_in_background for long-running commands, don't retry in sleep loops, and keep sleep durations to 1-5 seconds
• Sandbox description restructured into a more readable format

Background agents and bash tasks no longer generate periodic progress polling messages. Instead, the system now relies entirely on completion notifications.

When users kill running background agents (via the kill-agents shortcut), the system now sends a descriptive notification into the conversation.

The system prompt for selecting relevant memories has been rewritten to be more selective and discerning.

The Write tool description now explicitly recommends the Edit tool for modifications:

• Old: "ALWAYS prefer editing existing files in the codebase. NEVER write new files unless explicitly required."
• New: "Prefer the Edit tool for modifying existing files — it only sends the diff. Only use this tool to create new files or for complete rewrites."

File creation and log file operations now use more secure flag combinations:

• O_EXCL flag added for temp file creation (prevents TOCTOU race conditions)
• O_NOFOLLOW flag used on supported platforms (prevents symlink-following attacks)
• Log file open now uses explicit flag combinations (O_WRONLY | O_CREAT | O_APPEND | O_NOFOLLOW) instead of the legacy "a" mode string

The file encoding detection function now handles expected filesystem errors (ENOENT, EACCES, EPERM) gracefully with a debug-level log message instead of reporting them as unexpected errors.

Several improvements to the Remote Control bridge infrastructure:

• State reporting: The bridge now reports "processing" and "idle" states to the server, enabling better status visibility on claude.ai/code
• SSE event handling refactored: Delivery updates and catch-up truncation events are now handled via a generic setOnEvent callback, with catch-up truncation elevated to a proper error log
• Session creation/archival now accepts explicit baseUrl and getAccessToken parameters, improving BYOC (Bring Your Own Credentials) support
• Compaction boundary events are now tagged with is_compaction: true when written to the bridge transport
• Bridge REPL error: The replBridgeError state now preserves the first error rather than overwriting it

The terminal renderer now supports entering and exiting an alternate screen buffer via enterAlternateScreen() / exitAlternateScreen() methods, replacing inline ANSI escape sequences. Used by the year-in-review playback feature.

The bash command newline injection check has been updated with a more comprehensive regex pattern that better handles line continuations (backslash-newline sequences) as legitimate, while still catching suspicious newline patterns.

A new unquotedKeepQuoteChars field is now returned from command parsing, providing a third representation of commands alongside withDoubleQuotes and fullyUnquoted. This variant preserves quote characters in the output, enabling more accurate security analysis of commands where quote placement matters (e.g., the new mid-word hash check).

Environment variables are now loaded from userSettings, flagSettings, and policySettings in addition to user config, giving admins more control over the runtime environment.

A new Zod schema defines the structure returned by listSessions, including fields for sessionId, summary, lastModified, fileSize, customTitle, firstPrompt, gitBranch, and cwd.

MCP client state updates are now batched using a 16ms debounce timer, reducing React re-renders when multiple MCP servers report status changes in quick succession.

The dedicated "Bash" agent type (described as "Command execution specialist for running bash commands") has been removed from the built-in agent list. This simplifies the agent architecture.

The tree-sitter command parser now recursively processes pipeline nodes instead of treating them the same as redirected_statement. This improves accuracy when analyzing piped commands for security checks.

The internal glob-to-regex pattern matching function now accepts an optional case-insensitive flag, enabling case-insensitive permission rule matching.

The trust dialog bypass for bypassPermissions mode has been removed. Previously, bypassPermissions mode could skip the trust dialog entirely; now the standard trust checking flow applies regardless.

• Fixed Remote Control initialization to preserve the first error message rather than overwriting it with a generic "initialization failed" message (search for "replBridgeError")
• Fixed file index .gitignore loading to use async readFile instead of sync readFileSync with existsSync, preventing potential blocking I/O during file picker operations (search for "[FileIndex] loaded ignore patterns")
• Fixed the glob base path extraction on Windows to consider both / and \\ as path separators (search for "lastIndexOf")
• Fixed conversation rewind to properly reset state by calling Ft() after rewind (search for "tengu_conversation_rewind")
• Fixed atomic file write error logging to use level: "error" instead of the default level (search for "Failed to write file atomically")
• Removed extraneous blank line before <fast_mode_info> in the environment info system prompt