release aidev BREAKING SIG 4/5

Claude Code 2.1.196: MCP self-approval hole closed, Remote Control off on non-Anthropic base URLs

Security fix: claude mcp list/get no longer spawn .mcp.json servers a repo self-approved through a committed .claude/settings.json. Remote Control is now disabled whenever ANTHROPIC_BASE_URL points at a non-Anthropic host, which affects anyone routing through a local proxy. Also fixes a background-job path that could permanently delete a conversation.

PUBLISHED2026-06-29
OBSERVED2026-08-11
AGE1mo
SOURCES1
  • Security: claude mcp list/get no longer spawn .mcp.json servers self-approved via a committed .claude/settings.json; untrusted workspaces show ⏸ Pending approval
  • Behavior change: Remote Control disabled when ANTHROPIC_BASE_URL points at a non-Anthropic host, matching existing CLAUDE_CODE_USE_BEDROCK/_VERTEX/_FOUNDRY behavior
  • Fix (data loss): waking a background job permanently deleting its conversation and re-running the original prompt when the transcript probe misread a real transcript — the file is now set aside, never deleted
  • New: organization default models set in the org console, shown as "Org default"/"Role default" in /model
  • New: readable default session names; clickable file attachments in chat (Cmd/Ctrl-click reveals in Finder/Explorer)
  • Changed: streaming idle watchdog on by default for all providers — aborts and retries after 5 minutes with no stream events; disable with CLAUDE_ENABLE_STREAM_WATCHDOG=0
  • Changed: opening the agents view from a foreground session takes one ← instead of two
  • Fix: claude agents --dangerously-skip-permissions silently falling back to auto mode instead of showing the bypass disclaimer and applying bypass to spawned agents
  • Fix: MCP OAuth requesting the authorization server's full scopes_supported catalog when no scope is specified, causing invalid_scope failures on GitLab self-hosted and other enterprise IdPs
  • Fix: rate-limit warning flicker and over-counted rate-limit telemetry under parallel requests
  • Fix: PowerShell git diff/git grep, egrep/fgrep, and quoted | patterns reported as failures on exit 1
  • Fix: mid-turn crash recovery for Remote sessions; sessions moved with /cd reappearing in the old resume list; Esc Esc at an idle prompt not opening the rewind menu
  • Fix: /context showing 0 tokens for all tool groups on Bedrock; /deep-research misreporting verifier failures as "all claims refuted" instead of unverified
  • Fix: claude plugin validate skipping local plugins with source "." and stopping after the first error class; plugin dependency version pins ignored for local-folder marketplaces
  • Improved: background sessions survive process stop/restart/update, including Windows (background shells handed off, not killed); daemon-killed workers auto-resume
  • Improved: /code-review merged five cleanup finders into one, ~25% less token usage; reduced per-frame TUI rendering work during streaming
securitybreakingfixfeature

COMMUNITY

No curated reactions recorded for this event. Facts and takes are kept in separate layers — community context is added by hand, never blended into the record above.