Claude Code v2.1.319 发布：调整 auto mode 网关行为并新增 MCP 任务后台支持

## What's changed

- Changed auto mode with telemetry or feature flags off, including behind LLM gateways: calls the server can't check are asked about or denied, with no fallback to the built-in classifier; set `CLAUDE_CODE_AUTO_MODE_SERVER=0` to keep using it (Bedrock, Vertex and Foundry are unchanged) - Changed auto mode behind an LLM gateway: `CLAUDE_CODE_AUTO_MODE_SERVER=1` turns on the server-side check even with `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS` set; if managed settings set the latter, they must set the `1` too - Added support for MCP tasks in the terminal: when an MCP server runs a tool call as a task, Claude Code moves it to the background right away and tells Claude the result when it finishes - Added the `CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND` environment variable to make Claude Code wait for an MCP task inside its tool call instead of moving it to the background right away - Added `permissions.denyInsteadOfPrompting` setting: a tool call that would wait on a permission prompt is denied and the turn continues, in terminal sessions, subagents and teammates - Added `/claude-api latency-optimize` to find where your Claude API code makes people wait and try faster settings against your eval - Added the `CLAUDE_CODE_DISABLE_FEATURE_FLAGS` environment variable, which stops feature-flag fetching without turning off telemetry; every flag then uses its built-in default - Added spend for today, this week and this month to `/usage` for developers behind a Claude apps gateway who have no spend limit, when the gateway runs this version or later - Added `admin.pooled_conflict_rule` and `admin.pooled_priority_order` to the Claude apps gateway, to set which pooled group budget pays first for a developer in several groups - Added an optional `login_notice` setting to the Claude apps gateway that shows an operator-defined message on the gateway's browser verification page and on Claude Code's sign-in screen - Added `CLAUDE_GATEWAY_LOG_FORMAT=json` to the Claude apps gateway: operational log lines become JSON with `severity`, `time` and `message`, for log collectors that read the level from a field - Added a Claude apps gateway boot warning for a case where another policy's `availableModels` also allows a custom model id that one policy lists by name - Added start-up warnings to the Claude apps gateway for policies with no `desktopHome` that rely on `coworkTabEnabled: false` or `chatSessionRetentionDays`, ahead of Claude Desktop's November 10 change - Added a warning when your claude.ai login ends and Claude Code continues on the sign-in from `ant auth login`, which bills usage to your Claude Console organization - Added a line at startup naming the Claude Console organization that is billed in a case where Claude Code uses the sign-in from `ant auth login` - Added an "Earlier in this session" row to `/tasks` that lists finished subagents, so you can reopen one and message it even after it leaves the list or you restart - Added a note to `/loop` confirmations in cloud sessions that a timer stops with its container, with an offer of a loop that survives - Fixed MCP servers on the older handshake failing to connect, or returning empty results, because Claude Code declared an extension that it only uses with newer servers - Fixed a long-running MCP tool call on a claude.ai connector sometimes never reporting its result after `--resume` - Fixed a session's diff failing to load on claude.ai and the mobile apps when the folder Claude Code runs in has a file or folder named `HEAD` - Fixed `/diff` showing "Diff unavailable" when a git repository has a file or folder named `HEAD` at its top level - Fixed the `/diff` pane opening blank in sessions where 64 or more turns edited files - Fixed slash commands typed after a leading space, tab or newline being sent to Claude as plain text instead of running - Fixed a request that kept failing with a 401 refreshing your login on every retry and causing 401s in your other sessions - Fixed `/context` sending its full visual grid to Claude on every later turn; Claude now reads only the table - Fixed `claude -p` exiting 0 in auto mode when its actions were refused because no safety check was available: text and JSON output now exit 1 - Fixed a case where Claude Code listed every project file at start on Linux for projects on a network file system (NFS, SMB, Lustre and similar) - Fixed a case where auto mode was wrongly refused when a client sent a model change and a request for auto mode back to back - Fixed `/status` showing "Auto mode server: Enabled" when the server-side review isn't reaching the session, for example behind an LLM gateway that drops it - Fixed Claude-drafted feedback, surveys and `/feedback` continuing to appear after the server refused feedback for your organization - Fixed Claude drafting feedback on third-party gateways, where it can't be sent - Fixed auto mode refusing actions without saying why when permission rules or `autoMode` settings are very large: it now explains and, unless `autoMode` deny rules are set, asks you in the terminal - Fixed a case where Bash deny and ask rules missed commands written with quoted words - Fixed subagent hand-back reports showing an internal marker and provenance note when expanded outside verbose mode - Fixed `claude -p --resume` with a prompt losing a deferred tool call when its MCP server is missing: the run now exits 1, keeps the call and refuses later input - Fixed a case where text was dropped from informational messages sent to SDK clients - Fixed a case where Agent SDK hosts got a generic exit-code error instead of a failed run's own error message when the disk was full - Fixed `CLAUDE_CODE_RESUME_INTERRUPTED_TURN` re-running a turn that was interrupted in plan mode when the session resumes in another permission mode - Fixed edits to a settings file being ignored when made within a few seconds of Claude Code writing that file - Fixed a config file left at the legacy name hiding your setup with no warning: Claude Code now says on stderr when a home holds two config files, and which is in use - Fixed `~/.claude.json`, settings and edited files ending up empty or cut off when the disk fills during a save in a read-only folder or to a bind-mounted file (one session saving at a time) - Fixed Write ending the turn as a refusal when it couldn't read the file to overwrite - Fixed background Bash commands that finish almost instantly losing their output while being reported as completed - Fixed the Bash tool's diff of changed files missing a file that the command wrote just before it ended - Fixed a mistyped model name, such as `opus-5-5`, telling you to update Claude Code instead of suggesting the model you meant - Fixed a case where `NotebookEdit` changed the wrong cell when the notebook changed while a permission prompt was open - Fixed a ~0.5s hang after pressing Enter on the `/login` success screen: the dialog now dismisses immediately and the post-login refresh runs in the background - Fixed Ctrl+G not opening the external editor while typing an "Other" answer to a question in screen reader mode - Fixed Monitor's WebSocket watch failing with "could not resolve" behind a proxy when `CLAUDE_CODE_PROXY_RESOLVES_HOSTS` is set and the machine has no DNS of its own - Fixed `claude plugin eval` warnings suggesting `max: 0` for a tool that must not be called, which could never pass - Fixed background plugin auto-update not installing a dependency added by the updated plugin version - Fixed Cmd+click not opening links in Ghostty over tmux in sessions opened from the agents view - Fixed a mod's hot reload in `.claude/skills` missing a file that was deleted just after it appeared, and missing its return - Fixed `/rewind` failing with "No files were restored" when restoring code to a checkpoint from before `/branch` - Fixed the `/claude-api` skill saying Console web settings don't apply to Managed Agents sessions, and tightened its credential and permission examples - Fixed needless permission prompts for read-only commands wrapped in a plain `timeout DURATION`, such as `timeout 30 rg foo` - Fixed WebFetch describing claude.ai shared-chat links as empty pages; it now says shared chats can't be read and to paste the conversation instead - Fixed Artifact database calls being re-sent to artifacts without a database; errors now say whether republishing helps - Fixed a case where artifact database reads that save to a folder (`out_dir`) were refused - Fixed detailed beta tracing not presenting `CLAUDE_CODE_CLIENT_CERT` to collectors that require a client certificate - Fixed the OpenTelemetry `claude_code.session.count` metric counting Agent SDK `prewarm()` processes that were never claimed; a pre-started process now counts once, when it is claimed - Fixed `/clear` killing running commands of background agents, teammates and workflows that keep running, and foreground subagents of background agents and teammates - Fixed a terminal whose Claude apps gateway sign-in had expired sending telemetry and managed-settings requests that the gateway refused and logged as `invalid_token` - Fixed the agents view appearing to send a reply to a background session waiting on a permission prompt; the reply now stays in the box with a hint to open the session and answer - Fixed agent view removing a draft saved by another agent view in the same directory when exiting - Fixed a case where agent view came back with another agent view's input text after restarting itself for an update - Fixed the agents view preview cutting off long commands, results and status lines without an ellipsis, and dropping `**`, backticks and tags from commands waiting for approval - Fixed Claude in Chrome reporting the extension as not connected when the connection dropped mid-action; Claude now checks the page before repeating an action that may have run - Fixed Remote Control sessions still showing "Limit reached" on other devices after a usage limit was lifted outside the session - Fixed the file card sometimes missing in the Claude iOS app when Claude sent a single file - Fixed self-hosted runner sessions failing with no explanation when the server keeps refusing to renew model access: the runner now retries sooner and posts a warning in the session - Fixed `/permissions` in cloud sessions replying only that it isn't available; it now says where the session's rules live and how to change them - Fixed cloud sessions losing session-scoped deny and ask permission rules, such as those a PermissionRequest hook adds, when the session moves to a new worker - Fixed mod hot-reloading turning off for the session when you typed three messages instead of answering its question in a cloud session - Fixed background tasks that keep running after `/clear` disappearing from the task list in Claude Code on the web until another task started or ended - Fixed hidden commands appearing in the slash command menu of cloud sessions on mobile and web - Fixed a case where `/rewind` could restore or delete a file through a directory symlink - Fixed a case where a `sed` command could skip the permission check in accept-edits and auto mode - Fixed a case where `CLAUDE_CODE_AUTO_MODE_SERVER=1` in managed settings was ignored behind an LLM gateway when the gateway's URL is set only there and server-managed settings can't be fetched - Fixed a Bash permission bypass where a crafted environment prefix could hide part of a command from permission checks - Fixed a case where deny and ask rules, hook matchers and `disallowedTools` entries written with a claude.ai connector's terminal name (`mcp__claude_ai_Slack`) were ignored in Claude Desktop (takes effect once Claude Desktop includes this version) - Fixed a sandbox escape when creating a worktree - Fixed self-hosted runners: `--trust-workspace false` now also stops hooks in the repository's settings files and skills from running - Fixed a case where idle background sessions started through a shell-exported LLM gateway left the gateway after an update - Fixed help links in `/status` and the auto mode billing notice opening only part of the address when they wrap - Fixed a case where certificate errors behind a TLS-inspecting proxy persisted when `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` was set. With it set, Claude Code now makes a TLS handshake with the configured API host after a certificate failure, through your http:// proxy if one is set; it sends no API request - Fixed `claude remote-control` exiting silently with status 0 when a first-run question gets no answer (scripts, services, batch jobs, Ctrl+C); it now says why and exits 1 - Fixed `claude remote-control` ignoring a piped `y` that has no newline after it at the first-run question; it now counts as a yes - Fixed `/rename` reporting plain success when the new name could not be saved to the session transcript; it now warns that the new name may not last - Fixed `${CLAUDE_PLUGIN_ROOT}` not being substituted in a plugin-provided `subagentStatusLine` command, which can now reference the plugin's own scripts - Fixed `claude plugin update` and `/plugin` "Update now" not installing dependencies added by the new plugin version - Fixed subagents being told after compaction to expect a completion notice for background agents they neither started nor took over - Fixed a case where a background agent's later report was lost silently: the notification now says it was refused and how to ask for it - Improved config saves on Windows: Claude Code waits longer for a file another program has open, so a kill during a save is less likely to leave `~/.claude.json` empty - Improved Claude in Chrome after a brief disconnect: it waits up to 6 seconds for the session's own browser to return before picking another - Improved Claude in Chrome: `javascript_tool` results of up to 60,000 characters now stay in the conversation instead of being saved to a file - Improved `claude purge` and the clean-up of old sessions to retry a folder that could not be fully deleted, and to report it as an error if it remains - Improved the refusal for a path outside the working directories on macOS and Windows: when only its letter case differs from a path inside them, the message names that spelling - Improved the contrast of faint gray secondary text, such as hints, details in `/stats`, `/model` and `/sandbox`, and rejected-action messages - Improved the artifact database error when an update targets a document that does not exist, and when the service pauses repeated refused writes - Improved the Claude apps gateway's warnings about a failed upstream call: each now names the upstream, not only its provider - Improved the Claude apps gateway's spend limit error: it reads "spend limit reached · resets Dec 1", then `admin.blocked_message` if one is set - Improved the `/model` picker: older models are now grouped under a "More models" row instead of being listed after the current ones - Improved `/context` at the terminal so the table Claude reads stays short: each list keeps its 10 largest rows, and MCP tools that load on demand share one row per server until they're called - Improved `/usage` in cloud sessions: it now links to Settings → Usage on claude.ai in a case where plan limits can't be shown - [VSCode] Improved the confirmation for removing a plugin marketplace: it now checks which of its plugins are installed at that moment - Changed MCP tasks to work in the terminal without feature-flag fetching (Bedrock, Vertex, Foundry, LLM gateways, `DISABLE_TELEMETRY`); set `CLAUDE_CODE_DISABLE_MCP_TASKS=1` to turn them off - Changed auto mode so that a project's settings files or a plugin can no longer switch its server-side check back on once you have switched it off outside the project - Changed Monitor's WebSocket watch to follow a rule on every Bash command: a deny refuses it, and under an ask rule an allow on Monitor, bypass mode or auto mode no longer skips the prompt - Changed `CLAUDE_CODE_PROXY_RESOLVES_HOSTS` so that settings files can no longer set it where the host manages the network; set it in the process environment - Changed a session's exact Bash or PowerShell ask rule to be refused, not asked about, when a broader deny rule covers the command - Changed the Bash tool to ask for permission before running `which` with flags outside a lookup/display set - Changed `--add-dir` directories to register plugin marketplaces only once that directory's own trust dialog has been accepted - Changed nested skill loading: with the Bash sandbox on, skills in `.claude/skills` folders below the starting folder load only if you start Claude Code there or `/cd` there - Changed self-paced `/loop` to end when a turn finishes without rescheduling, instead of scheduling a fallback wakeup; set `CLAUDE_CODE_LOOP_KEEPALIVE=1` to keep the old behavior - Changed PostToolUse hooks to run, with up to 10 seconds to finish, on tool calls that finish after a new message interrupts the turn - Changed what Claude is told after safeguards stop a subagent: retry with a narrower prompt or tell you, instead of doing the work itself - Changed cloud sessions to drop session-scoped allow rules at a move to a new worker when their deny and ask rules can't all be kept, so you may be asked again - Changed the automatic certificate repair behind a TLS-inspecting proxy: it no longer runs when `ALL_PROXY` is the only proxy variable set. Set `HTTPS_PROXY` to the proxy's http:// URL instead - Changed artifact database saves of rows others may have written: each file gets a hidden marker file, and existing files without one, earlier versions' exports among them, are left alone and reported - Updated `/claude-api managed-agents-onboard` templates to match the Claude Console: removed Performance tuner, renamed two, and turned off web search and fetch in five whose prompts don't use them - Removed `shortcuts_list` and `shortcuts_execute`, which listed and started shortcuts saved in the extension, from Claude Code's built-in Claude in Chrome tools - Gateway: Added startup warnings for upstreams that mix AWS GovCloud with other upstreams, and for base URL variables in the gateway's environment - Gateway: Added a start-up log warning when managed settings name an Amazon Bedrock guardrail in a header, which the gateway doesn't forward, and no `bedrock` upstream sets a `guardrail` - Gateway: Fixed Claude Desktop offering a web search tool that always failed when every upstream is Amazon Bedrock - Self-hosted runner: Fixed a runner started with `--use-anthropic-git-proxy` or `--configure-git` registering before a failed startup check made it exit; it now exits first - Self-hosted runner: Changed `CLAUDE_RUNNER_CHECKOUT_PATH` so that each repository in a session gets its own folder: a folder name already taken in the session gets `-2`, `-3`, … at the end - Self-hosted runner: Removed the end-of-session upload of a session's debug log; a failed session's log stays on the runner host unless `--remove-session-state` is set - [VSCode] Fixed prompts over 50,000 characters being cut off silently: the prompt now stays in the chat box with a notice, and a paste over the limit is refused with a notice - [VSCode] Fixed a click on the survey or "Report a problem" buttons sending the unfinished prompt - [VSCode] Fixed cloud sessions opened from the extension's Web tab bringing back turns that `/clear`, or Retry or Edit of a typed prompt, had removed - [VSCode] Fixed a deleted session's file coming back when that session was renamed in the extension - [VSCode] Fixed Claude carrying out an unapproved plan after a window reload: a step interrupted in plan mode now stops with a notice when the session comes back in another permission mode - [VSCode] Improved the "not signed in" message behind a Claude apps gateway: it now looks like an error and has a Sign in link - [VSCode] Changed links in Claude's replies that point at Claude sign-in, connector or API addresses to show as text with the address, instead of opening in the browser - [VSCode] Fixed a possible chat panel freeze when a dropped item's path contains a very long run of "/" characters - [VSCode] Fixed the `claude-vscode.toggleDictation` command starting dictation in every open Claude view at once; it now acts only in the view you are using, and a second press stops it - [VSCode] Fixed the chat panel slowing down while a reply with many unclosed `$$` math fences, each shorter than the last, streams in - [VSCode] Improved the chat panel's diagnostics tool for large workspaces: it leaves out files with no problems, returns compact JSON, and accepts an optional minimum severity - [Cloud sessions] Fixed scheduled tasks silently dropping a connector named memory: runs now keep it, mounted under that name plus a short suffix - [Cloud sessions] Fixed Send now on a waiting message in cloud sessions ending running background agents; they now keep running - [Cloud sessions] Improved the stalled-setup warning on self-hosted environments: its link now prefers your organization's default or an environment with a live runner, and names it - [Code Review] Changed unlinking a GitHub organization to also turn off its All repositories setting in Code Review; it stays off after you relink until you turn it back on - [Claude Tag] Fixed Claude Tag setup blocking launch when the channel list couldn't fully load; admins can now launch without picking a channel - [Claude Tag] Added a Claude Tag row to the Models admin page for Enterprise orgs with Claude Tag connected, linking to where its model defaults are managed - [Claude Tag] Fixed saving auto mode allow rules in Claude Tag admin settings overwriting another admin's changes; the save is now refused with a message