Jonathon's AI Wiki

What's New in Claude Code — Week 33 (August 11–14, 2026)

18 min read

Source: ai-research/claude-code-docs-changelog-2026-08-14.md — changelog snapshot covering v2.1.228 through v2.1.233, August 11–14, 2026, captured 2026-08-14. Also references ai-research/claude-code-docs-whats-new-w32-2026-08-14.md for the auto mode context. Continues Week 32; the reference tables in CLI Reference carry the new flags and settings.

Five releases across the week — v2.1.228 (2026-08-11), v2.1.229 (2026-08-12), v2.1.231 (2026-08-13), v2.1.232 (2026-08-13), and v2.1.233 (2026-08-14). The changelog skips v2.1.230; no public release exists at that version number.

Two stories dominate. The first is an expansion of the agentic surface: subagent forking is now on by default and @ session mentions let you address any live session by name directly from the prompt — cross-session messaging went from an explicit API to a natural interaction pattern in a week. The second is GitLab landing across the full stack: marketplace URLs, token redaction, MR references in worktree output, and CLI hints. Today, August 14, is also when auto mode becomes the default for Pro, Max, and Team plans — announced in the W32 digest, effective now.

Key Takeaways

  • Subagent forking is on by default (v2.1.232). A subagent_type: "fork" agent inherits the full conversation and prompt cache, not a blank slate. Non-teammate agents spawned in interactive sessions now run in the background rather than blocking. The model picks up your context without a copy-past-to-subagent step; the cost is that fork agents are heavier than purpose-spawned ones — each inherits the whole cache.
  • Type @ to mention a session (v2.1.232). @ in the prompt opens session autocomplete; Claude uses SendMessage automatically. This is the natural-language face of the cross-session messaging surface shipped in v2.1.224; SendMessage no longer requires an explicit tool call in your workflow.
  • GitLab landed across the stack (v2.1.232, v2.1.233). Bare gitlab.com URLs (including nested subgroups) clone in plugin marketplaces. MR URLs appear in --worktree output as !N. Seven GitLab token families get secret redaction; glab CLI gets the same sandbox and credential-path protection as gh. If you were blocking GitLab from your toolchain because Claude Code treated it as unrecognized, that reason is gone.
  • Todo tools removed from Opus 4.8, Sonnet 5, Fable 5, and Mythos 5+ (v2.1.233). TaskCreate, TaskGet, TaskUpdate, TaskList, and TodoWrite are no longer available on these models. Restore with CLAUDE_CODE_ENABLE_TODO_TOOLS=1. This is a default behavior change — any workflow that relied on the Todo tool loop on newer models breaks silently unless you set the env var.
  • Auto mode is now the default (effective 2026-08-14). Announced in the W32 digest, taking effect today on Pro, Max, and Team plans. If your own settings.json already set a default mode, it stays; you will see a one-time switch prompt if you have not yet accepted it.
  • Write tool overwrite without a prior read on newer models (v2.1.228). Older models still require the session to have read a file before overwriting it; newer models follow the same rules as Edit. This closes a papercut in agentic file-update flows that didn’t need the file’s prior content.
  • /commit-push-pr no longer auto-approves dangerous git flags (v2.1.229). Commands with --force, --amend, --no-verify, and similar flags now pause for manual approval. This is a safety change worth knowing if you have automated push workflows using the slash command.
  • Plugin marketplace command sources (v2.1.229). A command source type lets a local process (e.g., an IDE) print the plugin directory each session; the directory is re-resolved on each start and applied without a restart. Enables local-dev plugin workflows where the directory path is dynamic.
  • Two MCP OAuth fixes in two days. v2.1.229: localhost → 127.0.0.1 in the redirect URI to satisfy strict authorization servers. v2.1.231: pre-registered OAuth client support (Slack was the named example — Slack’s OAuth flow requires a pre-registered client and was broken before this fix).
  • Memory cgroup support for Bash (v2.1.233, Linux, opt-in via CLAUDE_CODE_TOOL_MEMORY_LIMIT). A runaway build no longer stalls the session by consuming all memory; the Bash command gets killed instead.
  • MCP v2 connection loop fixed for serverless hosts (v2.1.233). Servers that terminate long-held streams on a fixed timeout (common in serverless) were causing Claude Code to endlessly reopen the subscriptions/listen stream. Fixed.
  • Three more security fixes across v2.1.232 and v2.1.233. PowerShell variable-writing parameters could silently redirect later commands’ file access; Windows NT \??\ device prefix paths bypassed UNC path validation (NTLM credential-leak vector); nested git repositories were inheriting trust from a parent directory. All three are now closed.

Auto mode takes effect today

The W32 digest announced that auto mode would become the default for new sessions on Pro, Max, and Team plans “starting August 14.” Today is August 14.

What this means in practice:

  • New sessions that have not set a default mode will start in auto mode.
  • If you already set "defaultMode" in ~/.claude/settings.json, it stays in place. You will see a one-time prompt asking whether to switch; declining keeps your existing default.
  • Organization-managed settings are unchanged.
  • Auto mode’s classifier calls do not count toward usage limits (already in effect for these plans before today’s change).

The first-use auto mode notice has also been updated to remove an outdated line suggesting auto mode costs more — as of the rate relief change earlier this year, it does not.

Subagent forking and @ session mentions (v2.1.232)

Forking is now the default path for subagents

subagent_type: "fork" was always available but required opting in. It is now on by default in the sense that non-teammate agent spawns in interactive sessions run in the background. A forked subagent inherits:

  • The full conversation history
  • The prompt cache (avoiding re-paying the cache miss on every agent)
  • The parent session’s tool configuration

The practical result is that agentic delegation from an interactive session no longer drops context — a forked agent can pick up mid-thought. The tradeoff is cache weight: a fork inherits the parent’s full cache, so spawning many forks from a long session is heavier than spawning purpose-built subagents from scratch. See Agent Teams for the trade-off map between fork, teammate, and background agents.

Session naming got a companion change: starting a session with a name already in use by another live session gives it a name-word-word variant and tells you, so @ mentions resolve without ambiguity.

@ mentions in the prompt

Type @ and a session name appears in autocomplete. Selecting it causes Claude to call SendMessage targeting that session directly — no explicit tool call, no ListAgents lookup needed first. SendMessage now also delivers to a bare name that matches exactly one live session without asking for a ref confirmation first.

This is a UX skin over the cross-session messaging API from v2.1.224 and v2.1.225 — the underlying channel (SendMessage, ListAgents, crossSessionInbound safety gate) is unchanged. What changed is how natural it is to use: it’s now the same muscle memory as @-mentioning a person in a chat thread.

ListAgents has also been updated to label disconnected Remote Control sessions as offline and cloud sessions as cloud, so the autocomplete list is more readable.

GitLab across the stack (v2.1.232, v2.1.233)

Plugin marketplaces

Bare gitlab.com repository URLs (including nested subgroups, e.g. gitlab.com/org/sub/repo) now work as plugin marketplace sources, cloned the same way github.com URLs are. Clone auth-failure hints now name your actual git host instead of assuming GitHub. The additionalMarketplaces and allowedMarketplaces settings keys are now accepted as friendlier aliases for extraKnownMarketplaces and strictKnownMarketplaces — the old names still work.

Enterprise policy also got a fix: a blockedMarketplaces entry using a bare repo URL now keeps blocking that URL when the CLI classifies it as a git clone.

Worktree output

--worktree output and the claude agents view now include GitLab merge request URLs, displayed as !N (the GitLab MR notation), matching how GitHub PR references appear in those views. See CLI Reference for the --worktree flag.

Secret redaction and sandbox

Seven GitLab token families now get secret redaction: glrt-, gloas-, glptt-, glagent-, glimt-, glsoat-, glcbt-, glft-, glffct-. Full redaction applies to glpat- and gldt- (routable tokens with wider blast radius). The glab CLI config store now gets the same sandbox and credential-path protection that gh has had for some time.

The GitHub app setup tip no longer appears in repositories whose origin is on gitlab.com or bitbucket.org. The enterprise marketplace tip now covers non-GitHub internal git hosts.

Todo tools removed from newer models (v2.1.233)

TaskCreate, TaskGet, TaskUpdate, TaskList, and TodoWrite are no longer available by default on Opus 4.8, Sonnet 5, Fable 5, Mythos 5, and newer models.

To restore: set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 in your environment.

The rationale is not stated in the changelog. The pattern is consistent with Anthropic removing scaffolding that newer-generation models are expected to handle differently — the Todo tools were a structured task-tracking layer that may have been adding friction rather than value on models that track state more naturally.

This is a default behavior change that breaks silently. Any workflow that depended on the model using TodoWrite or TaskCreate to manage its task list will stop doing so on these models unless you set the env var. If you observe a model that previously maintained a checklist but has stopped, check your model version and this env var.

Security and permissions

FixRelease
PowerShell variable-writing parameters could silently overwrite $PSDefaultParameterValues and redirect later commands’ file accessv2.1.232
Windows Git Bash followed Cygwin-style symlinks that path validation saw as regular files; writes through them now require permission approvalv2.1.232
Nested git repositories inheriting trust from a parent directory; each now requires its own trust confirmationv2.1.232
Windows NT \??\ device prefix paths bypassed UNC path validation, closing an NTLM credential-leak vectorv2.1.233
Hardened the auto-generated cross-session messaging socket directory on shared /tmp: a pre-planted symlink or another user’s directory is now refused instead of usedv2.1.232
Hardened the Linux filesystem sandbox against a protected-path bypassv2.1.232
sandbox.ripgrep can no longer be overridden by project settings; only user, managed, and --settings settings are honoredv2.1.232
Bash input redirections (< file) are now permission-checked like their argument spellings on all platformsv2.1.232
sandbox.bwrapPath, sandbox.socatPath, sandbox.ripgrep server-managed sandbox binary overrides now require explicit managed-settings approvalv2.1.232
Reverted the v2.1.232 Bash permission changes for Cygwin-style symlinks on Windows and for input redirections; a narrower version will return laterv2.1.233

The Windows NT \??\ path bypass and the PowerShell $PSDefaultParameterValues fix are both in the same class as the invisible-Unicode and trailing-slash bypass fixes from Week 32: a control that appeared strict but had a bypass path. The NTLM vector is the highest-impact one — \??\UNC\attacker\share could exfiltrate Windows credentials by routing a file open to an attacker-controlled SMB server.

The sandbox.ripgrep scoping change (v2.1.232) is also a supply-chain hardening move: project settings could previously redirect the sandboxed ripgrep binary, which is a code-execution vector for a malicious cloned repository.

The v2.1.233 revert of two v2.1.232 Bash changes is notable: when a permission fix is reverted a day later, the fix was either too broad (broke legitimate patterns) or had unintended interactions. The changelog notes “a narrower version will return in a later release” — watch for a follow-on.

MCP

OAuth redirect URI fix (v2.1.229)

localhost replaced with 127.0.0.1 in the OAuth redirect URI. Some authorization servers (ones that strictly validate redirect URIs without treating localhost and 127.0.0.1 as equivalent) were rejecting Claude Code’s sign-in redirect. See MCP for the full OAuth flow.

Pre-registered OAuth client support (v2.1.231)

MCP servers that use a pre-registered OAuth client — Slack is the named example — were failing with a redirect URI mismatch. Fixed. Slack’s OAuth flow requires the client to be pre-registered; v2.1.231 extends the OAuth handshake to handle that model.

MCP v2 connection loop fix (v2.1.233)

MCP v2 (the SSE-based transport) was endlessly reopening the subscriptions/listen stream against servers that terminate long-held streams on a fixed timeout. This is the common behavior of serverless hosts (Render, Railway, Cloud Run, Lambda, etc.), which shut idle TCP connections after ~30-60 seconds. Claude Code was reconnecting, getting the same termination, and looping indefinitely — consuming server quota and generating error noise. Fixed.

Other MCP fixes

  • MCP connections hanging for the full 30-second connect timeout when a server fails to answer or sends a malformed reply to the protocol-version probe (v2.1.232) — now fails fast.
  • SSE keepalive pings added to gateway streaming responses during long thinking pauses (v2.1.229) — prevents idle-timeout disconnects on Vertex and Bedrock upstreams.

Plugins and marketplaces

Command sources (v2.1.229)

A new command source type for plugin marketplaces: a local command (e.g., an IDE process) prints the plugin directory, which Claude Code re-resolves each session. Using mode: "link" applies it in place without copying.

This is the mechanism for IDE-local plugin workflows where the plugin directory is dynamic — the IDE starts, sets a socket or writes a temp directory, and the command source lets Claude Code pick that up fresh each session without requiring a static path in settings. See Plugins and Marketplaces for the full source type list.

/plugin install and marketplace refresh

/plugin install now refreshes the marketplace catalog before looking up the plugin, so newly published plugins install without a manual marketplace update step (v2.1.232). Previously, a plugin that had been published since your last catalog refresh would return “plugin not found” even though it existed.

additionalMarketplaces / allowedMarketplaces aliases (v2.1.232)

These are now accepted as aliases for extraKnownMarketplaces and strictKnownMarketplaces respectively. The older key names continue to work. The new names are more readable for settings that are maintained by hand.

claude plugin validate improvement (v2.1.233)

claude plugin validate now checks a bare .claude/skills directory, reporting any SKILL.md files whose frontmatter fails to parse. Previously it required a specific target path.

Write tool behavior change (v2.1.228)

On newer Claude models, the Write tool can now overwrite an existing file that has not been read this session. Older models still require the read first (matching the long-standing rule). The Edit tool has always allowed overwrites without a prior read; this change brings Write into alignment for newer models.

The practical effect: agentic file-generation flows that write output files, config files, or generated code no longer need to insert a dummy read step to satisfy the tool check. On older models, the behavior is unchanged.

New environment variables and settings (v2.1.233)

CLAUDE_CODE_TOOL_MEMORY_LIMIT

Opt-in memory cgroup support for Bash tool commands on Linux. Set a memory limit; a runaway build that exhausts it gets killed rather than stalling the entire session by consuming all system memory. Useful for CI-adjacent workflows where Claude Code runs builds or test suites.

CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS

Configures the TTL for the WebFetch session URL cache (default unchanged: 15 minutes). Useful when working with URLs that update more frequently than the default window, or when you want to extend the cache to avoid re-fetching stable reference material.

forward_user_identity (gateway setting)

An opt-in apps gateway setting on Anthropic upstreams. When enabled, the signed-in user’s identity is forwarded as headers, so a proxy behind the gateway can attribute spend per user. Relevant for enterprise deployments where per-user cost attribution matters. See Claude Managed Agents for the gateway context.

/commit-push-pr safety flags (v2.1.229)

/commit-push-pr now requires manual approval for any git or gh command that includes dangerous flags: --force, --amend, --no-verify, and equivalents. These were previously auto-approved as part of the slash command flow. This aligns /commit-push-pr with the general-purpose permission gate that already applies to standalone Bash commands with those flags.

Remote Control improvements (v2.1.232)

A large batch, mostly fixing states where Remote Control sessions lost or confused their identity across restarts:

  • Resuming a conversation whose session was deleted from claude.ai or the app now starts a replacement instead of failing with a login error (regression fixed from v2.1.227).
  • Resuming a conversation no longer silently takes Remote Control away from another Claude Code on the same machine that already holds it.
  • Fixed sessions appearing unreachable to newly attached clients while idle.
  • Fixed bridge sessions not restoring conversation history when the session worker restarts.
  • Fixed Remote Control sessions started from Claude Desktop or an IDE appearing as a new claude.ai session each time the local session was resumed; they now reattach to the existing one.
  • Fixed sessions hosted by a bridge inside a cloud session inheriting that session’s transcript or credentials.
  • Remote Control now reconnects for ~30 minutes after a network blip, rather than dropping after a few blips spread across an hour.
  • The terminal now reports whether a session was taken over by another device, ended from another app, or deleted — and stops suggesting a reconnect that would undo those actions.
  • Connected clients now see a reconnect shortcut when Remote Control fails, rather than only an error notification.

Also shipped: mTLS client certificate rotation no longer requires a restart (v2.1.232) — Claude Code reloads a rotated cert and key automatically on connection errors.

Quality of life

  • Cross-session messages now display inline (v2.1.228) — the sender and body appear directly instead of a collapsed “message” line that required expanding.
  • Fable 5 is available in /advisor again (v2.1.232) for organizations with Fable access, with usage-credits consent through /model fable.
  • /code-review at high, xhigh, and max effort now runs in a background agent (v2.1.232), matching the behavior already in place for lower effort levels. High-effort reviews no longer block the foreground session.
  • claude remote-control --continue (v2.1.229) documented as the way to resume the most recent Remote Control session — was functional but undocumented before this release.
  • Self-hosted runner hooks (v2.1.229) — server-supplied Claude Code hook support for self-hosted runner sessions now matches managed-environment behavior.
  • Workflow fan-out staggering (v2.1.229) — sibling agents with the same prompt prefix are staggered so subsequent agents read the cached prompt prefix instead of re-paying it. CLAUDE_CODE_WORKFLOW_PREFIX_STAGGER_MS=0 disables. This is a cost reduction for parallel workflow agents.
  • Vertex AI credential handling (v2.1.228) — expired or missing Google Cloud credentials now fail within seconds rather than retrying for minutes.
  • claude self-hosted-runner startup (v2.1.233) — the session branch is created without rewriting the working tree, and two server round trips no longer block launch. Meaningful improvement for high-frequency session starts.
  • Apps gateway error forwarding (v2.1.233) — 400/413 errors from Vertex, Foundry, and Claude Platform on AWS upstreams now carry the upstream’s own message.
  • Managed settings approval dialog (v2.1.232) — now shows endpoint URLs, uses clearer wording for telemetry-only changes, skips routine OpenTelemetry options, and requires explicit approval for server-managed sandbox binary overrides.
  • Print mode diagnostics (v2.1.233) — a [claude-code:unrecognized_model] line is written to stderr when a request uses an unrecognized model ID; map it with modelOverrides to silence.

Try It

  1. If you use subagent workflows, check whether fork-default behavior changes your cost profile — forked subagents are heavier than purpose-spawned ones because they inherit the full cache. If you were explicitly opting in to subagent_type: "fork" before, you may want to benchmark the difference now that it is on by default for non-teammate spawns.
  2. Set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 if your workflow relied on TodoWrite or TaskCreate on Opus 4.8, Sonnet 5, Fable 5, or Mythos 5+, and the model has stopped maintaining its task list.
  3. Try @ session mentions in an interactive session with two sessions open. Type @ and the session name, and Claude will route the message without an explicit SendMessage call.
  4. If you use GitLab repos as plugin marketplace sources, test bare gitlab.com URL installation — subgroups are now supported and no special prefix is needed.
  5. Check any /commit-push-pr automations for commands that use --force, --amend, or --no-verify — these now pause for manual approval.
  6. On Linux systems running build-heavy sessions, evaluate CLAUDE_CODE_TOOL_MEMORY_LIMIT for runaway-build protection.
  7. If you use an MCP server hosted on a serverless provider (Cloud Run, Railway, Lambda), update to v2.1.233 to fix the connection-loop issue that was consuming quota silently.
  8. If you authenticate with an MCP server that uses a pre-registered OAuth client (e.g., Slack), update to v2.1.231 — the redirect URI mismatch that was blocking sign-in is fixed.

Open Questions

  • Why were Todo tools removed from newer models? The changelog gives no rationale. The pattern is consistent with Anthropic pulling scaffolding from newer-generation models, but the specific reason — capability no longer needed, performance concern, design change, or something else — is not stated.
  • What is the “narrower version” of the reverted v2.1.232 Bash permission changes? Two permission changes were reverted in v2.1.233 (Cygwin-style symlinks on Windows; input redirections < file). No timeline or scope is given for the replacement.
  • No official W33 digest page exists yet — this article is compiled from the GitHub release notes directly, as Week 32 originally was. The official digest typically publishes after the week closes; W33 ends August 16.
  • Memory cgroup support scope — CLAUDE_CODE_TOOL_MEMORY_LIMIT is described as Linux-only; no macOS or Windows equivalent is mentioned.

Graph View

Backlinks