v2.1.260

Bug Fixes

• Fixed `Edit`/`Write`/`Read` permission rules with parentheses in their paths from being dropped by the Bash sandbox, which previously left 'read-only' folders writable.
• Fixed a file permission rule with an uncompilable pattern (e.g., an unclosed `[`) that caused all file edits to fail with 'Invalid regular expression'; such rules now guard the literal path.
• Fixed Bash permission checks that auto-approved zsh commands hiding command substitutions in assignments like REPORTTIME, REPORTMEMORY, or DIRSTACKSIZE; these now prompt for approval.
• Fixed Bedrock model discovery, token counting, and AWS SSO/STS credential calls failing with 'unable to get local issuer certificate' when the corporate root CA is only in the OS certificate store.
• Fixed `permissions.blockReadsOutsideWorkingDirectories` on macOS from hiding the user's git config from sandboxed git and a worktree-isolated sub-agent's checkout.
• Fixed managed settings not loading for claude.ai Enterprise/Team users who also had a leftover API key from an earlier `/login`.
• Fixed `/status` incorrectly listing a signed-in claude.ai account and a configured API key as both active; the inactive credential is now marked.
• Fixed managed `skillOverrides` entries keyed on a bundled skill's alias (e.g., `checkup` for `/doctor`) not applying, and `Skill(name)` deny rules not covering nested skills listed as `<dir>:name`.
• Fixed `model: fable` agents ignoring the `[1m]` tag on an `ANTHROPIC_DEFAULT_FABLE_MODEL` pin, causing them to silently run with a 200K context window.
• Fixed the `/model` picker not showing Fable 5.1 for eligible organizations, which was only accepted when typed as `/model claude-fable-5-1`.
• Fixed prompt caching on Claude Fable 5.1 not covering context after tool results, leading to it being resent as uncached input on every tool-call turn.
• Fixed model switching remaining blocked for the session after a plugin hook load failure; switches now re-check and the refusal names the cause.
• Fixed model switching being blocked for the session when an organization-managed plugin's marketplace could not be loaded.
• Fixed SDK-provided MCP servers (e.g., Desktop connectors) sometimes missing on the first turn and only appearing on the next.
• Fixed Claude in Chrome tools failing with 'Not connected' mid-task in cloud-hosted claude.ai sessions when a connector was added or removed.
• Fixed flags, joined emoji, and accented letters splitting across wrapped lines, and stale text remaining on screen when a flag or joined emoji fell in the terminal's last two columns.
• Fixed Remote Control accepting an invalid model pick, which now results in an error instead of failing on the next message.
• Fixed `/rewind` and `--rewind-files` reporting success when checkpoint backup files were missing and no restoration occurred.
• Fixed `/rewind` leaving stale file-read tracking from rewound turns, causing 'File unchanged since last read' stubs and re-injection after external edits.
• Fixed `-p --resume`/`--continue` (used by the desktop app) failing on every retry once a session's worktree directory lost its git metadata; it now fails once and then resumes without the worktree.
• Fixed a subagent resuming another agent via SendMessage never being woken by that agent's completion, with notifications going to the main conversation instead.
• Fixed agent teams where an in-process teammate's transcript lost messages or went blank during long API retry waits due to retry notices evicting real messages.
• Fixed a session that moved to the background appearing twice in ListAgents (as a phantom 'interactive' twin) and receiving SendMessage deliveries in the viewer.
• Fixed intermittent 'task output swap refused' errors when many sessions share a project directory.
• Fixed Ctrl+Z in fullscreen leaving the shell on the alternate screen, drawn over the paused interface.
• Fixed Workflow tool subagents being restarted as stalled while a long context compaction was in progress.
• Fixed plugins from a URL marketplace failing to install with 'marketplace entry path does not stay inside the marketplace directory' when a host app stores it as a directory.
• Fixed an extra browser tab opening when an artifact is published in a session driven from claude.ai, the desktop app, or mobile (Remote Control).
• Fixed the Artifact tool's first call failing with an 'Invalid tool parameters' validation error in some Cowork sessions.
• Fixed IDE line selections being dropped when running a skill or slash command; the 'N lines selected' context now reaches Claude.
• Fixed repository detection for GitLab projects in nested subgroups (e.g., `gitlab.com/group/subgroup/project`).
• Fixed `owner/repo#123` issue references in rendered output linking to github.com when working in a GitLab repository; they now link to the gitlab.com issue.
• Glob/Grep: Fixed the search path being probed on disk before the permission check; missing paths are now reported after permission is decided, similar to Read.
• Reverted the 2.1.259 change applying `Read()` deny rules to Bash arguments, which incorrectly denied `npm run build` under a `Read(./**/build/**)` rule and caused `cd … && grep` to prompt even in auto mode.