claude-code

v2.1.160 Breaking

This release includes 2 breaking changes for platform teams planning a safe upgrade.

Published 2d Developer Productivity

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Affected surfaces

auth rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 1d

The release adds interactive prompts before writing to sensitive shell config files and build‑tool configuration files, enhancing security. It also removes the deprecated CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE environment variable and renames the dynamic‑workflow trigger from `workflow` to `ultracode`.

Why it matters: Security prompts prevent unintended command execution when modifying .zshenv, .bash_login, .npmrc, etc.; removal of CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE forces no‑op behavior; renaming the trigger keyword breaks existing automation that uses `workflow`.

Summary

AI summary

Removed two environment variables and renamed the ultracode trigger from "workflow" to "ultracode".

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Adds prompts before writing to sensitive shell config files (.zshenv, .zlogin, .bash_login) and ~/.config/git/ to prevent unintended command execution Adds prompts before writing to sensitive shell config files (.zshenv, .zlogin, .bash_login) and ~/.config/git/ to prevent unintended command execution Source: llm_adapter@2026-06-02 Confidence: high	—
Security	Critical	Adds prompts before writing build‑tool config files (.npmrc, .yarnrc, bunfig.toml, .bazelrc, .pre-commit-config.yaml, .devcontainer/) that grant code execution Adds prompts before writing build‑tool config files (.npmrc, .yarnrc, bunfig.toml, .bazelrc, .pre-commit-config.yaml, .devcontainer/) that grant code execution Source: llm_adapter@2026-06-02 Confidence: high	—
Breaking	High	Deprecates and removes the `CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE` environment variable; it is now a no‑op Deprecates and removes the `CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE` environment variable; it is now a no‑op Source: llm_adapter@2026-06-02 Confidence: high	—
Breaking	High	Renames dynamic‑workflow trigger keyword from `workflow` to `ultracode`; `workflow` no longer triggers a run Renames dynamic‑workflow trigger keyword from `workflow` to `ultracode`; `workflow` no longer triggers a run Source: llm_adapter@2026-06-02 Confidence: high	—
Performance	Medium	Improves performance of opening recently‑inactive background agent sessions in `claude agents` Improves performance of opening recently‑inactive background agent sessions in `claude agents` Source: llm_adapter@2026-06-02 Confidence: high	—
Performance	Medium	Improves auto‑mode classifier latency by reducing reasoning on routine actions, lowering "could not evaluate this action" blocks Improves auto‑mode classifier latency by reducing reasoning on routine actions, lowering "could not evaluate this action" blocks Source: llm_adapter@2026-06-02 Confidence: high	—
Deprecation	Medium	Removes JetBrains plugin install suggestion from startup Removes JetBrains plugin install suggestion from startup Source: granite4.1:30b@2026-06-02-audit Confidence: low	—
Bugfix
Bugfix	Medium	Fixes copy‑on‑select not writing to Windows clipboard on WSL by using PowerShell interop instead of OSC 52 Fixes copy‑on‑select not writing to Windows clipboard on WSL by using PowerShell interop instead of OSC 52 Source: llm_adapter@2026-06-02 Confidence: high	—
Bugfix	Medium	Fixes restoring a completed session from `claude agents` dropping chat history and re‑running the original prompt Fixes restoring a completed session from `claude agents` dropping chat history and re‑running the original prompt Source: llm_adapter@2026-06-02 Confidence: low	—
Bugfix	Medium	Fixes background sessions re‑attached after overnight retire losing their conversation and re‑running the original prompt Fixes background sessions re‑attached after overnight retire losing their conversation and re‑running the original prompt Source: llm_adapter@2026-06-02 Confidence: low	—
Bugfix	Medium	Fixes `claude --bg` occasionally failing with "socket missing" when the background daemon cold‑starts on a loaded machine Fixes `claude --bg` occasionally failing with "socket missing" when the background daemon cold‑starts on a loaded machine Source: llm_adapter@2026-06-02 Confidence: low	—
Bugfix	Low	Fixes Windows directory deletion after `claude rm` until the background daemon exits Fixes Windows directory deletion after `claude rm` until the background daemon exits Source: granite4.1:30b@2026-06-02-audit Confidence: low	—
Bugfix	Low	Fixes background agents shown under Completed in the agents list after resuming work Fixes background agents shown under Completed in the agents list after resuming work Source: granite4.1:30b@2026-06-02-audit Confidence: low	—
Bugfix	Low	Fixes `claude agents` freezing due to auto‑updater re‑checking on every exit Fixes `claude agents` freezing due to auto‑updater re‑checking on every exit Source: granite4.1:30b@2026-06-02-audit Confidence: low	—
Bugfix	Low	Fixes input unresponsiveness (Esc, arrows, typing) on Windows under heavy CPU load when attached to a background session or in agent view Fixes input unresponsiveness (Esc, arrows, typing) on Windows under heavy CPU load when attached to a background session or in agent view Source: granite4.1:30b@2026-06-02-audit Confidence: low	—
Bugfix	Low	Fixes terminal sync‑output markers emitted by background agents to terminals that don't support them (Apple Terminal, tmux) Fixes terminal sync‑output markers emitted by background agents to terminals that don't support them (Apple Terminal, tmux) Source: granite4.1:30b@2026-06-02-audit Confidence: low	—
Bugfix	Low	Fixes mouse wheel scrolling prompt history instead of transcript after opening a session from the agents list Fixes mouse wheel scrolling prompt history instead of transcript after opening a session from the agents list Source: granite4.1:30b@2026-06-02-audit Confidence: low	—
Bugfix	Low	Fixes CJK IME composition appearing at bottom‑left rather than at input caret in `claude agents` view Fixes CJK IME composition appearing at bottom‑left rather than at input caret in `claude agents` view Source: granite4.1:30b@2026-06-02-audit Confidence: low	—
Bugfix	Low	Fixes rewriting of valid `file:///C:/...` links to broken paths on Windows terminals with hyperlink support Fixes rewriting of valid `file:///C:/...` links to broken paths on Windows terminals with hyperlink support Source: granite4.1:30b@2026-06-02-audit Confidence: low	—
Bugfix	Low	Fixes voice mode connection failure when project directory or branch name contains non‑ASCII or special characters Fixes voice mode connection failure when project directory or branch name contains non‑ASCII or special characters Source: granite4.1:30b@2026-06-02-audit Confidence: low	—
Bugfix	Low	Corrects auto‑mode unavailability message on third‑party providers to reference `CLAUDE_CODE_ENABLE_AUTO_MODE` opt‑in Corrects auto‑mode unavailability message on third‑party providers to reference `CLAUDE_CODE_ENABLE_AUTO_MODE` opt‑in Source: granite4.1:30b@2026-06-02-audit Confidence: low	—
Bugfix	Low	Fixes `/effort ultracode` incorrectly blaming dynamic workflows setting when the model cannot run xhigh; disables ultracode on unsupported models Fixes `/effort ultracode` incorrectly blaming dynamic workflows setting when the model cannot run xhigh; disables ultracode on unsupported models Source: granite4.1:30b@2026-06-02-audit Confidence: low	—
Bugfix	Low	Fixes model‑not‑found errors suggesting `--model` flag in SDK or non‑CLI hosts where it is irrelevant Fixes model‑not‑found errors suggesting `--model` flag in SDK or non‑CLI hosts where it is irrelevant Source: granite4.1:30b@2026-06-02-audit Confidence: low	—
Bugfix	Low	Prevents Claude's past replies from disappearing from scrollback when resuming a brief‑mode session with brief mode off Prevents Claude's past replies from disappearing from scrollback when resuming a brief‑mode session with brief mode off Source: granite4.1:30b@2026-06-02-audit Confidence: low	—
Bugfix	Low	Fixes vim mode `p` pasting on the line below instead of at cursor when register was yanked with `v$` Fixes vim mode `p` pasting on the line below instead of at cursor when register was yanked with `v$` Source: granite4.1:30b@2026-06-02-audit Confidence: low	—
Refactor	Low	Improves background‑session teardown to send SIGTERM before SIGKILL, allowing cleanup handlers to run Improves background‑session teardown to send SIGTERM before SIGKILL, allowing cleanup handlers to run Source: granite4.1:30b@2026-06-02-audit Confidence: low	—

Full changelog

What's changed

Added a prompt before writing to shell startup files (.zshenv, .zlogin, .bash_login) and ~/.config/git/, which could otherwise lead to unintended command execution
acceptEdits mode now prompts before writing build-tool config files that grant code execution (.npmrc, .yarnrc*, bunfig.toml, .bazelrc, .pre-commit-config.yaml, .devcontainer/, etc.)
Edit no longer requires a separate Read after viewing a file with grep: single-file grep/egrep/fgrep commands now satisfy the read-before-edit check
Fixed copy-on-select not writing to the Windows clipboard on WSL — now uses PowerShell interop instead of OSC 52, which terminals like MobaXterm don't support
Fixed restoring a completed session from claude agents dropping chat history and re-running the original prompt
Fixed background sessions re-attached after overnight retire losing their conversation and re-running the original prompt
Fixed claude --bg occasionally failing with "socket missing" when the background daemon was cold-starting on a loaded machine
Fixed an issue on Windows where the directory a background session was started in could not be deleted after claude rm until the background daemon exited
Fixed background agents that resumed work being shown under Completed in the agents list
Fixed claude agents freezing for several seconds when returning to the session list due to the auto-updater re-checking on every exit
Fixed Esc, arrow keys, and typing becoming unresponsive on Windows when attached to a background session or in the agent view while the host is under heavy CPU load
Fixed background agents emitting terminal sync-output markers to terminals that don't support them (Apple Terminal, tmux), causing render artifacts when entering a running agent
Fixed mouse wheel scrolling prompt history instead of the transcript right after opening a session from the agents list
Fixed CJK IME composition appearing at the bottom-left of the screen instead of at the input caret in the claude agents view
Fixed valid file:///C:/... links being rewritten to a broken path on Windows terminals with hyperlink support
Fixed voice mode failing to connect when the project directory or branch name contains non-ASCII or special characters
Fixed the auto mode unavailability message on third-party providers (Bedrock/Vertex/Foundry) to point to the CLAUDE_CODE_ENABLE_AUTO_MODE opt-in instead of incorrectly blaming the model
Fixed /effort ultracode incorrectly blaming the dynamic workflows setting when the model cannot run xhigh; ultracode is no longer offered on models that do not support it
Fixed model-not-found errors suggesting --model when running via the SDK or other hosts where the CLI flag doesn't apply
Fixed Claude's past replies disappearing from scrollback when resuming a brief mode session with brief mode turned off
Fixed vim mode p pasting on the line below instead of at the cursor when the register was yanked with v$
Improved performance of opening recently-inactive background agent sessions in claude agents
Improved auto mode classifier latency by reducing reasoning on routine actions, lowering the chance of "could not evaluate this action" blocks
Improved background-session teardown (claude rm/stop, idle reap) to send SIGTERM to running shell subprocesses before SIGKILL, so cleanup handlers run
Removed CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE; the environment variable is now a no-op
Removed the JetBrains plugin install suggestion from startup
Renamed the dynamic-workflow trigger keyword from workflow to ultracode. The word "workflow" no longer triggers a run; asking for one in your own words still works. The trigger keyword is highlighted in violet in the prompt input

Breaking Changes

Removed environment variable `CLAUDE_CODE_OPUS_4_6_FAST_MODE_OVERRIDE`; now a no-op.
Renamed dynamic‑workflow trigger keyword from "workflow" to "ultracode"; "workflow" no longer triggers.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track claude-code

Get notified when new releases ship.

About claude-code

All releases →

Related context

Related tools

Earlier breaking changes

v2.1.147 Renames /simplify to /code-review; removes cleanup-and-fix behavior.