This release includes breaking changes for platform teams planning a safe upgrade.
✓ No known CVEs patched in this version
ReleasePort's take
Moderate signalClaude Code v2.1.141 isolates third-party provider auth tokens and patches 23 stability issues across MCP, Remote Control, and plugin integrations.
Why it matters: Third-party sessions now properly isolated from host auth tokens, eliminating cross-session leakage. MCP and Remote Control fixes address connection stability and token rotation failures; deploy to harden auth boundaries and integration resilience.
Summary
AI summaryAdded terminalSequence hook field for desktop notifications and several bug fixes across UI, permissions, plugins, and integrations.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Security | Medium |
Third-party provider sessions no longer inherit auth tokens from host Third-party provider sessions no longer inherit auth tokens from host Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
ANTHROPIC_WORKSPACE_ID scopes federation token to specific workspace ANTHROPIC_WORKSPACE_ID scopes federation token to specific workspace Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Feature | Medium |
Hooks can emit desktop notifications without controlling terminal Hooks can emit desktop notifications without controlling terminal Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Added CLAUDE_CODE_PLUGIN_PREFER_HTTPS for HTTPS plugin cloning Added CLAUDE_CODE_PLUGIN_PREFER_HTTPS for HTTPS plugin cloning Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
Rewind menu adds 'Summarize up to here' for context compression Rewind menu adds 'Summarize up to here' for context compression Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
claude agents --cwd option scopes session list to directory claude agents --cwd option scopes session list to directory Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Medium |
/feedback now includes recent sessions from last 24 hours or 7 days /feedback now includes recent sessions from last 24 hours or 7 days Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Feature | Low |
Added `terminalSequence` field to hook JSON output for desktop notifications, window titles, and bells without a terminal. Added `terminalSequence` field to hook JSON output for desktop notifications, window titles, and bells without a terminal. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Feature | Low |
Added `CLAUDE_CODE_PLUGIN_PREFER_HTTPS` environment variable to clone GitHub plugin sources over HTTPS. Added `CLAUDE_CODE_PLUGIN_PREFER_HTTPS` environment variable to clone GitHub plugin sources over HTTPS. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Feature | Low |
Auto‑mode permission dialog explains when a `permissions.ask` rule triggered the prompt. Auto‑mode permission dialog explains when a `permissions.ask` rule triggered the prompt. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Feature | Low |
Improved plugin menu navigation: `→`/Tab switch tabs, `↑` moves to tab strip; headers and search box clickable in fullscreen. Improved plugin menu navigation: `→`/Tab switch tabs, `↑` moves to tab strip; headers and search box clickable in fullscreen. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Performance | Low |
Spinner feedback now warms to amber after 10 seconds during long thinking periods. Spinner feedback now warms to amber after 10 seconds during long thinking periods. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Bugfix | Medium |
/model change in one session no longer affects other sessions /model change in one session no longer affects other sessions Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Background side-queries fall back to main model when Haiku unavailable Background side-queries fall back to main model when Haiku unavailable Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
Ctrl+C interrupts running turn in vim INSERT/VISUAL mode Ctrl+C interrupts running turn in vim INSERT/VISUAL mode Source: llm_adapter@2026-05-21 Confidence: high |
— |
| Bugfix | Medium |
awsCredentialExport always runs when configured on Bedrock awsCredentialExport always runs when configured on Bedrock Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Remote Control MCP connectors handle token rotation without failing Remote Control MCP connectors handle token rotation without failing Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
/tui refuses to drop running background shells and subagents /tui refuses to drop running background shells and subagents Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
SDK finds native binary on Linux with glibc and musl packages SDK finds native binary on Linux with glibc and musl packages Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Remote MCP servers stay connected when server-events stream fails Remote MCP servers stay connected when server-events stream fails Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
claude agents falls back to fresh launch on unhealthy worker claude agents falls back to fresh launch on unhealthy worker Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Remote Control handles stale token without re-enrollment loop Remote Control handles stale token without re-enrollment loop Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
MCP configs with POSIX parameter expansions recognized as valid MCP configs with POSIX parameter expansions recognized as valid Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Error overlay shows original error message not minified source Error overlay shows original error message not minified source Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Feedback bundle redaction produces valid JSON for quoted values Feedback bundle redaction produces valid JSON for quoted values Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Multi-line statusline handles long lines without corruption Multi-line statusline handles long lines without corruption Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
claude daemon status and /doctor handle locked pipe file on Windows claude daemon status and /doctor handle locked pipe file on Windows Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
claude plugin install handles missing marketplace refs with sha claude plugin install handles missing marketplace refs with sha Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Early OTel spans captured in SDK/headless mode with tracing Early OTel spans captured in SDK/headless mode with tracing Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
MCP servers show config issue message when variables unset MCP servers show config issue message when variables unset Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Background agents preserve current permission mode when launched Background agents preserve current permission mode when launched Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Hooks receive correct transcript_path after EnterWorktree Hooks receive correct transcript_path after EnterWorktree Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Enter key in permission prompt no longer submits input text Enter key in permission prompt no longer submits input text Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Permission mode switch auto-dismisses tool-permission prompts Permission mode switch auto-dismisses tool-permission prompts Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
Restored 'view diff in IDE' option on file-edit permission prompts Restored 'view diff in IDE' option on file-edit permission prompts Source: llm_adapter@2026-05-21 Confidence: low |
— |
| Bugfix | Medium |
`claude daemon status` and `/doctor` on Windows now show underlying error instead of opaque failure when pipe key file is locked/unreadable. `claude daemon status` and `/doctor` on Windows now show underlying error instead of opaque failure when pipe key file is locked/unreadable. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Bugfix | Medium |
Background jobs on custom `ANTHROPIC_BASE_URL` gateway now auto‑name using the main model when Haiku is not configured. Background jobs on custom `ANTHROPIC_BASE_URL` gateway now auto‑name using the main model when Haiku is not configured. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Bugfix | Low |
`claude agents` shows dashboard instead of agent‑type list when launched through a wrapper adding flags. `claude agents` shows dashboard instead of agent‑type list when launched through a wrapper adding flags. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Bugfix | Low |
`claude agents` no longer fires redundant dispatches on crashed session with deleted working directory. `claude agents` no longer fires redundant dispatches on crashed session with deleted working directory. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Bugfix | Low |
Markdown tables with cell wrapping render as bordered grid instead of falling back to vertical key‑value layout. Markdown tables with cell wrapping render as bordered grid instead of falling back to vertical key‑value layout. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Bugfix | Low |
Cancelled prompts are no longer removed from Up‑arrow history when auto‑restored, avoiding duplicates. Cancelled prompts are no longer removed from Up‑arrow history when auto‑restored, avoiding duplicates. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Bugfix | Low |
Prompts cancelled with Ctrl+C/Esc before any response are retained in Up‑arrow history. Prompts cancelled with Ctrl+C/Esc before any response are retained in Up‑arrow history. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Bugfix | Low |
Alternative `chat:submit` keybindings (e.g., meta+enter, ctrl+enter) work when `enter` is rebound to `chat:newline`.` Alternative `chat:submit` keybindings (e.g., meta+enter, ctrl+enter) work when `enter` is rebound to `chat:newline`.` Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Bugfix | Low |
Prompt suggestions are no longer silently disabled when an output style is configured. Prompt suggestions are no longer silently disabled when an output style is configured. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Bugfix | Low |
`spinnerVerbs` setting is honored in turn‑completion messages. `spinnerVerbs` setting is honored in turn‑completion messages. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Bugfix | Low |
AskUserQuestion popup no longer hides the last line of preceding chat content. AskUserQuestion popup no longer hides the last line of preceding chat content. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Bugfix | Low |
Web Search status shows correct search count even when searches return errors. Web Search status shows correct search count even when searches return errors. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
| Bugfix | Low |
Multi‑line statusline output no longer drops or corrupts rows when a line exceeds terminal width. Multi‑line statusline output no longer drops or corrupts rows when a line exceeds terminal width. Source: granite4.1:30b@2026-05-22-audit Confidence: low |
— |
Full changelog
What's changed
- Added
terminalSequencefield to hook JSON output so hooks can emit desktop notifications, window titles, and bells without a controlling terminal - Added
CLAUDE_CODE_PLUGIN_PREFER_HTTPSto clone GitHub plugin sources over HTTPS instead of SSH, for environments without a GitHub SSH key - Added
ANTHROPIC_WORKSPACE_IDenvironment variable for workload identity federation — scopes the minted token to a specific workspace when the federation rule covers more than one - Added
claude agents --cwd <path>to scope the session list to a directory /feedbackcan now include recent sessions (last 24 hours or 7 days) for issues spanning more than the current session- Rewind menu: added "Summarize up to here" to compress earlier context while keeping recent turns intact
- Auto mode permission dialog now explains when a
permissions.askrule caused the prompt - Restored the "view diff in your IDE" option on file-edit permission prompts when an IDE is connected
- Background agents launched via
/bgor←←now preserve the current permission mode instead of reverting to default claude agents: agents that finish work but leave a background shell running now move to Completed instead of staying under Working- Improved spinner feedback during long thinking periods — the spinner now warms to amber after 10 seconds to signal Claude is still working
- Improved plugin menu navigation:
→/Tab switch tabs,↑moves to the tab strip, and tab headers and search box are clickable in fullscreen mode - Fixed background side-queries sending an unavailable Haiku model ID on Bedrock/Vertex/Foundry/gateway when no
ANTHROPIC_SMALL_FAST_MODELoverride is set — now falls back to the main-loop model - Fixed
claude daemon statusand/doctoron Windows throwing when the daemon pipe key file is locked or unreadable — now shows the underlying error instead of an opaque failure - Fixed
claude agentsshowing the agent-type list instead of the dashboard when launched through a wrapper that adds flags - Fixed
claude agentsopening a crashed session firing redundant dispatches when the working directory was deleted - Fixed background jobs on a custom
ANTHROPIC_BASE_URLgateway not getting auto-named — the namer now uses the main model when no Haiku model is configured - Fixed
/modelin one session silently changing the autocompact threshold in other concurrent sessions - Fixed switching permission mode while a tool-permission prompt is open not auto-dismissing the prompt when the new setting permits the tool
- Fixed pressing Enter while a permission/dialog prompt is open also submitting text in the input box
- Fixed hooks receiving a non-existent
transcript_pathafterEnterWorktreeswitches the working directory - Fixed markdown tables with cell wrapping falling back to the vertical key-value layout instead of rendering as a bordered grid (regression in 2.1.136)
- Fixed cancelled prompts being removed from Up-arrow history when auto-restored into the input box, avoiding duplicate entries
- Fixed prompts cancelled with Ctrl+C/Esc before any response being dropped from Up-arrow history
- Fixed Ctrl+C not interrupting a running turn while in vim INSERT/VISUAL mode
- Fixed alternative
chat:submitkeybindings (e.g.meta+enter,ctrl+enter) not working whenenteris rebound tochat:newline - Fixed prompt suggestions being silently disabled when an output style was configured
- Fixed
spinnerVerbssetting not being honored in turn-completion messages - Fixed AskUserQuestion popup hiding the last line of preceding chat content
- Fixed Web Search status showing "Did 0 searches" when searches returned errors
- Fixed multi-line statusline output dropping or corrupting rows when any line exceeds terminal width
- Fixed light-ansi theme using invisible white for diff context lines on light backgrounds — now uses black
- Fixed error overlay dumping minified bundle source that hid the original error message
- Fixed pressing Enter after typing a feedback survey rating digit submitting it as a chat message instead of the rating
- Fixed pressing
xon a selected subagent in the agent panel typing into the prompt instead of stopping the agent - Fixed session title being derived from plugin monitor notifications before the user's first prompt
- Fixed "Allowed by PermissionRequest hook" repeating once per tool call under a collapsed read/search group
- Fixed
/tuisilently dropping running background shells and subagents — now refuses and asks to wait for them to finish - Fixed welcome banner showing "API Usage Billing" on Bedrock, Vertex, Foundry, and other third-party providers — now shows the provider name
- Fixed
/mcpserver list not keeping the focused server visible in short terminals in fullscreen mode - Fixed redaction in
/feedbackbundles producing invalid JSON for quoted values like session IDs - Fixed desktop and third-party provider sessions incorrectly inheriting
apiKeyHelper/ANTHROPIC_AUTH_TOKENfrom host managed-settings - Fixed early analytics events being silently dropped when fired before logger initialization
- Fixed
claude plugin installfailing for plugins whose marketplacerefno longer exists upstream when ashais also pinned - Fixed plugin details pane showing 0 MCP servers for plugins that declare them via
.mcp.json - Fixed plugin MCP servers with unset config variables showing a generic connection failure instead of a "config issue" message with a fix-it hint; malformed
.mcp.jsonentries no longer drop other MCP servers - Fixed MCP server configs using POSIX shell parameter expansions (e.g.
${var%pattern}) being incorrectly flagged as missing environment variables - Fixed MCP HTTP/SSE servers returning 403 on connect showing as "failed" instead of "needs auth"
- Fixed remote MCP servers disconnecting unnecessarily when the optional server-events stream failed to reconnect — tool calls continue over POST
- Fixed Remote Control MCP connectors all failing with 401 when the worker session token rotated mid-session
- Fixed Remote Control automatically re-enrolling a trusted device when the server rejects a stale token, instead of looping through
/login - Fixed a race where early OTel spans could be silently dropped in SDK/headless mode with beta tracing enabled
- Fixed custom
voice:pushToTalkkeybindings and"space": nullunbinds being silently ignored - Fixed Windows Alt+V image paste reporting "no image found" when the clipboard contains a screenshot
- Fixed SDK "Claude Code native binary not found" on Linux when both glibc and musl platform packages are installed
- Bedrock:
awsCredentialExportnow always runs when configured instead of being skipped when ambient AWS credentials resolve, fixing auth for cross-account access - [VSCode] Fixed in-chat mic showing no feedback when the microphone produced only silence — now shows "No audio detected"
- [VSCode] Voice mode: the WSL error now suggests installing
sox libsox-fmt-pulsefor WSLg users claude agents: launching a session no longer fails when the pre-warmed background worker is unhealthy — now falls back to a fresh launchclaude agentsno longer shows empty placeholder sessions left over from backgrounding a fresh REPL, and shows onboarding text when entered via ← with no other agents- Empty idle background sessions left over from
←are now automatically retired by the daemon after 5 minutes
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About claude-code
All releases →Related context
Related tools
Earlier breaking changes
- v2.1.160 Renames dynamic‑workflow trigger keyword from `workflow` to `ultracode`; `workflow` no longer triggers a run
- v2.1.160 Deprecates and removes the `CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE` environment variable; it is now a no‑op
- v2.1.147 Renames /simplify to /code-review; removes cleanup-and-fix behavior.
Beta — feedback welcome: [email protected]