Adds claude self-hosted-runner, letting Team and Enterprise plans run web, mobile, and desktop sessions on their own machines or containers, plus cross-session SendMessage/ListAgents so sessions on any of your machines can message each other. Also expands sandbox credential masking and changes what the feedback survey uploads.
Fixes three permission-enforcement holes — a crafted Bash command hiding parts of itself from permission checks, workflow scripts escaping the sandbox via dynamic import(), and agent-definition bypassPermissions ignoring the org disable policy. /review becomes an alias of /code-review, and auto-compaction now enforces context windows more broadly.
Fixes two containment holes: worktree-isolated sessions and their subagents could run destructive git commands against the main checkout, and PreToolUse auto-allow hooks bypassed tool restrictions in background agent tasks. The ultraplan feature is removed, and repo-local settings can no longer enable Remote Control.
Fixes a Bash permission-check bypass where zsh could execute hidden commands inside [[ ]] regex conditionals, plus a Windows PowerShell path-quoting mishandling in permission checks. Adds credential masking for sandboxed commands on Linux/WSL and changes /fork to create its own worktree.
Adds claude-opus-5 with a 1M context window as the new default Opus model, priced at $10/$50 per Mtok in fast mode. Also raises the default subagent nesting depth from 1 to 3 and drops Opus 4.7 from fast mode, both of which change behavior for existing setups.
A large maintenance release that moves /code-review into a background subagent, tightens trust rules around agent frontmatter hooks, and changes several defaults. Anyone with agent files whose names contain a colon, or skills using context: fork, will see behavior change without any action on their part.
Subagents no longer spawn nested subagents unless CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH is set, and concurrent subagents are capped at 20 by default — both change existing multi-agent fan-out setups. --max-budget-usd now denies new spawns and halts running background agents once the cap is hit.
Adds sandbox.filesystem.disabled to skip filesystem isolation while keeping network egress control, and fixes message normalization cost growing quadratically with turn count, which caused multi-second stalls and slow resumes. Several worktree and symlink isolation holes are closed.