내 버전부터 최신까지

[What's changed] Removed the `--sandbox` and `--no-sandbox` flags from `claude remote-control`, which had no effect; passing either now exits with an error. Set `sandbox.enabled` in settings to sandbox sessions

[What's changed] Changed claude.ai connectors to negotiate MCP protocol version 2026-07-28 by default on installs that fetch no flags; `MCP_PROTOCOL_NEGOTIATION=legacy` opts out

[What's changed] Changed `CLAUDE_CODE_DISABLE_ATTACHMENTS` so a repository's `.claude/settings.json` or `.claude/settings.local.json` can no longer set it; shell, user and managed settings still can

[What's changed] Self-hosted runner: Changed the runner to stop passing `CCR_AUTO_MODE_ALLOW`, `CCR_AUTO_MODE_ENVIRONMENT` and `CCR_AUTO_MODE_SOFT_DENY` into a session's environment

[What's changed] Changed `claude project purge` to `claude purge`; the old name still works and prints a notice

[What's changed] [Claude Tag] Added a private Allow once / Deny card in Slack threads for connector actions that need your approval, so Claude asks instead of refusing; others only see that it's waiting on you

[What's changed] Added idle compaction in the terminal: a 200K+ token conversation left idle for about 54 minutes is compacted before its one-hour prompt cache expires, so your next message doesn't reprocess it all

[What's changed] Added an optional `models` list to every Claude apps gateway upstream: only the listed models are sent there, on failover too, and one `*` in an entry is a wildcard

[What's changed] Added an `effort` parameter to the Agent tool, so Claude runs a sub-agent at the effort level you ask for

[What's changed] [Claude Tag] Changed the organization-wide and default spend limit boxes on Claude Tag's spend limits page in admin settings to save only when you press Save or Enter, not when you click away

[What's changed] Improved Claude in Chrome: a `browser_batch` call now gets 90 seconds, up from 60, before it is reported as timed out

[What's changed] Changed the interactive session's WebSearch budget to refill over time (100 calls/hour; `CLAUDE_CODE_WEB_SEARCH_REFILLS_PER_HOUR` sets the rate, 0 turns it off) instead of ending after 200 calls

[What's changed] [Claude Tag] Added fast mode in Slack: mention Claude with `!fast` to switch a thread to fast mode, moving it to Opus if needed, and `!fast off` to switch back; replies show (fast) while it's on

[What's changed] Changed the background command time limit to apply only in unattended sessions (`-p`, Agent SDK, CI, cloud); terminal, desktop app and VS Code sessions have no limit

[What's changed] Fixed a case where a user-installed mod could make an organization's guard skip its check; such a mod is now unloaded

[What's changed] Fixed a dangerous `rm` (such as one on `/` or the home directory) inside a `bash -c` or `sh -c` script running without a prompt in bypassPermissions mode or under a shell allow rule (anthropics/claude-code#96300)

[What's changed] [Claude Tag] Fixed Claude in Slack not answering another app that tags it in a thread under a message Claude itself posted to the channel

[What's changed] [Code Review] Fixed Code Review's "paused for this repository" comment sending admins to Code Review settings; it now says who can fix it and links the Git providers page

[What's changed] Fixed a sandboxed shell command being able to write into a `--plugin-dir` folder, whose code Claude Code reloads and runs outside the sandbox

[What's changed] Fixed `claude mcp list`, `claude doctor` and `/status` reporting an empty `.mcp.json` as invalid

[What's changed] Fixed the Claude apps gateway serving models that a policy's `availableModelsMatch: exact` or `deniedModels` blocks; it now answers 400 and leaves them out of its model lists

[What's changed] Fixed the server-managed settings request to Anthropic carrying a third-party gateway's API key when a managed settings file sets `ANTHROPIC_BASE_URL`

[What's changed] Fixed a mod's `tool.describe` or `prompt.section` answer that changed after `$.ui.invalidate` never reaching Claude; the new answer is now sent on the next turn

[What's changed] Fixed sandboxed commands on macOS being able to read or write a denied path by its real location when the denied path passes through a symlink

[What's changed] Changed MCP allow rules to reach only the server they name: `mcp__a` no longer allows a server named `a__b` or `a_`; write `mcp__<server>__*` with the server's whole normalized name

[What's changed] [Cloud sessions] Fixed the Sessions and Runners lists in a self-hosted environment's admin details saying the list is empty when a search just has no matches

[What's changed] Fixed `--tools` and `--restricted` not applying to built-in tools that register after launch, and deprecated tool names reaching tools outside the caller's tool set

[What's changed] Fixed the notification for an MCP tool call that moved to the background showing a shortened task id

[What's changed] Fixed a skill's `allowed-tools` and `effort` being dropped when the Skill tool finished before the response stream ended, which denied the skill's Bash commands in `-p` runs

[What's changed] Fixed Edit treating a file as fully read when its contents changed without its modification time advancing

[What's changed] Fixed `/model` effort ←/→ wrapping past the highest or lowest level, which could accidentally save Low as a model's default effort

[What's changed] Fixed `claude agents` offering bypass permissions that background sessions then ignored when consent was saved only in `.claude/settings.local.json` or a `--settings` file; it now asks for consent first, and a session that ignores bypass shows a short notice that stays

[What's changed] Fixed a managed sandbox read-deny path (and user ones beside it) that appears or re-points mid-session not dropping project grants inside it or ending credential injection from files it covers

[What's changed] Fixed a notebook or PDF read on macOS and Windows being able to return a file outside what was approved, through a link swapped in mid-read

[What's changed] Fixed a tampered on-disk cache of server-managed settings being able to switch off or unseat the built-in policy plugin while the settings fetch failed

[What's changed] Fixed `rm -rf` on the 8.3 short name or another alternate Windows spelling of the home folder or a drive not being treated as removing it

[What's changed] Security: Fixed PreToolUse hook approvals and auto mode bypassing the permission prompt for file reads from network (UNC) paths

[What's changed] Fixed plan mode not being restored when resuming a session from the `claude --resume` session picker or with `/resume`

[What's changed] Fixed vim mode leaving the cursor past the end of a line, j/k losing their column on shorter lines, and `f`/`t`/`F`/`T`/`;`/`,` jumping to, or deleting up to, a match on another line of the prompt

[What's changed] Fixed a plugin's served `$` method restarting the hook origin, which could run a guard hook with a `.catch` above it again without end

[What's changed] Fixed a regression in 2.1.290 where cloud sessions could drop answers to permission prompts

[What's changed] Fixed resumed subagents and teammates losing their earlier thinking and prompt cache after receiving a message mid-run

[What's changed] Fixed an image read on macOS and Windows being able to return a file outside what was approved, through a link swapped in mid-read

[What's changed] Fixed a case where a user-installed mod could get an organization's plugin unloaded; the mod is now the one unloaded

[What's changed] Fixed an `@`-mention under the read block or `--restricted` being able to read a file outside the working directories through a link changed mid-read

[What's changed] Fixed errors reading "Premature close" instead of naming the missing program when a tool Claude Code runs, such as git or gh, is not installed (macOS, Linux)

[What's changed] [Cloud sessions] Fixed History on a never-run routine's page still saying "No runs yet" after you pressed Run now; it now shows the new run

[What's changed] Fixed a resumed session sometimes not saving the last response of a turn, so that the next `--resume` showed the prompt unanswered

[What's changed] Fixed permission asks that ended unanswered, in `-p` or on an interrupted turn, emitting no `tool_decision` event

[What's changed] Fixed `/login` reporting "Login successful" when credentials could not be saved to secure storage; it now shows the failure, and offers a retry when the new login didn't take effect (anthropics/claude-code#73861)

[What's changed] Fixed the keyboard not working on Windows after Claude Code restarts itself (first sign-in to a Claude apps gateway, provider setup, `/tui`)

[What's changed] Fixed the terminal cursor not following the typed text in the fullscreen transcript viewer's search and in `/theme`'s custom color search