내 버전부터 최신까지

[What's changed] Removed the `--sandbox` and `--no-sandbox` flags from `claude remote-control`, which had no effect; passing either now exits with an error. Set `sandbox.enabled` in settings to sandbox sessions

[What's changed] Changed claude.ai connectors to negotiate MCP protocol version 2026-07-28 by default on installs that fetch no flags; `MCP_PROTOCOL_NEGOTIATION=legacy` opts out

[What's changed] Changed `CLAUDE_CODE_DISABLE_ATTACHMENTS` so a repository's `.claude/settings.json` or `.claude/settings.local.json` can no longer set it; shell, user and managed settings still can

[What's changed] Changed /memory so that Auto-memory can no longer be turned on from a background session or from a session one of Claude Code's own tools started; turning it off there still works

[What's changed] Changed the MCP server name `widgets` to be reserved in cloud sessions and on self-hosted runners: your own server under it, or a close spelling such as `widgets_`, no longer loads, so rename it

[What's changed] Windows: Changed project and local settings `env` to no longer set `ALLUSERSPROFILE`, `SystemDrive`, or the `CommonProgramFiles` variables; set them in user or managed settings instead

[What's changed] Changed `/claude-api` so it can no longer be run from Remote Control clients

[What's changed] Self-hosted runner: Changed the runner to stop passing `CCR_AUTO_MODE_ALLOW`, `CCR_AUTO_MODE_ENVIRONMENT` and `CCR_AUTO_MODE_SOFT_DENY` into a session's environment

[What's changed] Changed `claude project purge` to `claude purge`; the old name still works and prints a notice

[What's changed] Removed the browser link from `/ultrareview` and `claude ultrareview` output

[What's changed] Fixed fast mode staying off in remote sessions owned by an agent with no user account, even when the organization allows it

[What's changed] Improved Workflow tool sandbox hardening for errors thrown by async script hooks

[What's changed] [Claude Tag] Added a private Allow once / Deny card in Slack threads for connector actions that need your approval, so Claude asks instead of refusing; others only see that it's waiting on you

[What's changed] Added idle compaction in the terminal: a 200K+ token conversation left idle for about 54 minutes is compacted before its one-hour prompt cache expires, so your next message doesn't reprocess it all

[What's changed] Added an optional `models` list to every Claude apps gateway upstream: only the listed models are sent there, on failover too, and one `*` in an entry is a wildcard

[What's changed] Added an `effort` parameter to the Agent tool, so Claude runs a sub-agent at the effort level you ask for

[What's changed] [Claude Tag] Changed the organization-wide and default spend limit boxes on Claude Tag's spend limits page in admin settings to save only when you press Save or Enter, not when you click away

[What's changed] Improved Claude in Chrome: a `browser_batch` call now gets 90 seconds, up from 60, before it is reported as timed out

[What's changed] Changed the interactive session's WebSearch budget to refill over time (100 calls/hour; `CLAUDE_CODE_WEB_SEARCH_REFILLS_PER_HOUR` sets the rate, 0 turns it off) instead of ending after 200 calls

[What's changed] [Claude Tag] Added fast mode in Slack: mention Claude with `!fast` to switch a thread to fast mode, moving it to Opus if needed, and `!fast off` to switch back; replies show (fast) while it's on

[What's changed] Changed the background command time limit to apply only in unattended sessions (`-p`, Agent SDK, CI, cloud); terminal, desktop app and VS Code sessions have no limit

[What's changed] Added Claude Mods: plugins may now modify deeper behavior

[What's changed] Added You should know, a built-in mod where a side agent watches your back and flags things you or Claude might miss. Turn it on with `/plugin enable cc-plugin-you-should-know@builtin` (for first-party sessions with telemetry on)

[What's changed] Improved handling of large MCP tool results: less memory, smaller session files, and no extra upload to count tokens for results far over the limit

[What's changed] Changed Opus 4.7+ and Fable to use a 1M context window by default on Bedrock, Vertex, Foundry and the Claude apps gateway, with no `[1m]` suffix (`CLAUDE_CODE_DISABLE_1M_CONTEXT=1` keeps 200K)

[What's changed] [VSCode] Added bookmarks: save Claude's responses and keep them in view in a Bookmarks side panel

[What's changed] Added `claude --desktop` to open the Claude desktop app on the current directory, or on a session with `--continue` / `--resume <id>`

[What's changed] Improved validation of git URLs for plugins, marketplaces and the current repository's remote

[What's changed] Improved Bedrock and Vertex start-up model checks: models your account cannot use are now remembered for up to a day instead of being re-checked on every launch

[What's changed] Changed sessions behind a custom `ANTHROPIC_BASE_URL` to use the 1M context window of models that have one (Opus 4.7+, Sonnet 5+, Fable); run `/autocompact 200k` if your gateway stops at 200K

[What's changed] [Claude Tag] Added direct messages with Claude for members on an Enterprise plan Standard or Usage-Based Chat seat who also have Cowork; a seat that includes Claude Code is no longer required

[What's changed] Added Claude Sonnet 5.5 (`claude-sonnet-5-5`), now the default Sonnet model on the Anthropic API — 1M context, $2/$10 per Mtok with $0.20/Mtok cache reads

[What's changed] Changed Ultracode into its own toggle in `/effort` (Tab, or `/effort ultracode [on|off]`): it no longer forces xhigh effort and stays on at any effort level

[What's changed] [VSCode] Added an optional time above each prompt and response, with a date line where the day changes (Claude Code: Show Message Timestamps setting, off by default)

[What's changed] Fixed a case where a user-installed mod could make an organization's guard skip its check; such a mod is now unloaded

[What's changed] Fixed a dangerous `rm` (such as one on `/` or the home directory) inside a `bash -c` or `sh -c` script running without a prompt in bypassPermissions mode or under a shell allow rule (anthropics/claude-code#96300)

[What's changed] [Claude Tag] Fixed Claude in Slack not answering another app that tags it in a thread under a message Claude itself posted to the channel

[What's changed] [Code Review] Fixed Code Review's "paused for this repository" comment sending admins to Code Review settings; it now says who can fix it and links the Git providers page

[What's changed] Fixed a sandboxed shell command being able to write into a `--plugin-dir` folder, whose code Claude Code reloads and runs outside the sandbox

[What's changed] Fixed `claude mcp list`, `claude doctor` and `/status` reporting an empty `.mcp.json` as invalid

[What's changed] Fixed the Claude apps gateway serving models that a policy's `availableModelsMatch: exact` or `deniedModels` blocks; it now answers 400 and leaves them out of its model lists

[What's changed] Fixed the server-managed settings request to Anthropic carrying a third-party gateway's API key when a managed settings file sets `ANTHROPIC_BASE_URL`

[What's changed] Fixed a mod's `tool.describe` or `prompt.section` answer that changed after `$.ui.invalidate` never reaching Claude; the new answer is now sent on the next turn

[What's changed] Fixed sandboxed commands on macOS being able to read or write a denied path by its real location when the denied path passes through a symlink

[What's changed] Changed MCP allow rules to reach only the server they name: `mcp__a` no longer allows a server named `a__b` or `a_`; write `mcp__<server>__*` with the server's whole normalized name

[What's changed] [Cloud sessions] Fixed the Sessions and Runners lists in a self-hosted environment's admin details saying the list is empty when a search just has no matches

[What's changed] Fixed `--tools` and `--restricted` not applying to built-in tools that register after launch, and deprecated tool names reaching tools outside the caller's tool set

[What's changed] Fixed the notification for an MCP tool call that moved to the background showing a shortened task id

[What's changed] Fixed a skill's `allowed-tools` and `effort` being dropped when the Skill tool finished before the response stream ended, which denied the skill's Bash commands in `-p` runs

[What's changed] Fixed Edit treating a file as fully read when its contents changed without its modification time advancing

[What's changed] Fixed `/model` effort ←/→ wrapping past the highest or lowest level, which could accidentally save Low as a model's default effort

[What's changed] Fixed `claude agents` offering bypass permissions that background sessions then ignored when consent was saved only in `.claude/settings.local.json` or a `--settings` file; it now asks for consent first, and a session that ignores bypass shows a short notice that stays

[What's changed] Fixed a managed sandbox read-deny path (and user ones beside it) that appears or re-points mid-session not dropping project grants inside it or ending credential injection from files it covers

[What's changed] Fixed a notebook or PDF read on macOS and Windows being able to return a file outside what was approved, through a link swapped in mid-read

[What's changed] Fixed a tampered on-disk cache of server-managed settings being able to switch off or unseat the built-in policy plugin while the settings fetch failed

[What's changed] Fixed `rm -rf` on the 8.3 short name or another alternate Windows spelling of the home folder or a drive not being treated as removing it

[What's changed] Security: Fixed PreToolUse hook approvals and auto mode bypassing the permission prompt for file reads from network (UNC) paths

[What's changed] Fixed plan mode not being restored when resuming a session from the `claude --resume` session picker or with `/resume`

[What's changed] Fixed vim mode leaving the cursor past the end of a line, j/k losing their column on shorter lines, and `f`/`t`/`F`/`T`/`;`/`,` jumping to, or deleting up to, a match on another line of the prompt

[What's changed] Fixed a plugin's served `$` method restarting the hook origin, which could run a guard hook with a `.catch` above it again without end

[What's changed] Fixed a regression in 2.1.290 where cloud sessions could drop answers to permission prompts

[What's changed] Fixed resumed subagents and teammates losing their earlier thinking and prompt cache after receiving a message mid-run

[What's changed] Fixed an image read on macOS and Windows being able to return a file outside what was approved, through a link swapped in mid-read

[What's changed] Fixed a case where a user-installed mod could get an organization's plugin unloaded; the mod is now the one unloaded

[What's changed] Fixed an `@`-mention under the read block or `--restricted` being able to read a file outside the working directories through a link changed mid-read

[What's changed] Fixed errors reading "Premature close" instead of naming the missing program when a tool Claude Code runs, such as git or gh, is not installed (macOS, Linux)

[What's changed] [Cloud sessions] Fixed History on a never-run routine's page still saying "No runs yet" after you pressed Run now; it now shows the new run

[What's changed] Fixed a resumed session sometimes not saving the last response of a turn, so that the next `--resume` showed the prompt unanswered

[What's changed] Fixed permission asks that ended unanswered, in `-p` or on an interrupted turn, emitting no `tool_decision` event

[What's changed] Fixed `/login` reporting "Login successful" when credentials could not be saved to secure storage; it now shows the failure, and offers a retry when the new login didn't take effect (anthropics/claude-code#73861)

[What's changed] Fixed the keyboard not working on Windows after Claude Code restarts itself (first sign-in to a Claude apps gateway, provider setup, `/tui`)

[What's changed] Fixed the terminal cursor not following the typed text in the fullscreen transcript viewer's search and in `/theme`'s custom color search

[What's changed] Fixed a dangerous `rm` (such as one on `/` or the home directory) losing its always-ask safeguard when the same command also redirected output to a `~` or wildcard path

[What's changed] Fixed a repeat MCP sign-in request from Claude replacing the pending sign-in link, which could stop that link from working

[What's changed] [VSCode] Fixed settings dialogs reporting a failed save, without re-checking, when Claude Code printed more than 1 MB of output

[What's changed] [Cloud sessions] Fixed clearing an organization environment's setup script in admin settings leaving new cloud sessions still running the old script

[What's changed] Fixed `/ultrareview` uploads including uncommitted changes to credential files whose name has a colon before the extension, such as `server:8443.key`

[What's changed] Fixed a failing API request being retried up to 21 times when streaming kept failing; the non-streaming fallback now shares the request's retry budget instead of getting a fresh set of retries

[What's changed] Changed sandbox settings so project settings cannot widen or turn off an admin-required sandbox, replace the proxy behind a managed deny list, extend a strict allowlist, or reopen managed read-denies

[What's changed] [VSCode] Fixed a Claude tab reloaded after an extension restart staying blank instead of saying how to recover

[What's changed] [VSCode] Fixed a user's own `/mcp`, `/config` or `/settings` command being shadowed by the extension's dialog