v2.1.98

Bug Fixes

• Fixed a Bash tool permission bypass where an escaped flag could be auto-allowed as read-only, potentially leading to arbitrary code execution.
• Fixed compound Bash commands bypassing forced permission prompts for safety checks and explicit ask rules in auto and bypass-permissions modes.
• Fixed read-only commands with environment variable prefixes not prompting unless the variable is known-safe (e.g., `LANG`, `TZ`).
• Fixed redirects to `/dev/tcp/...` or `/dev/udp/...` not prompting instead of auto-allowing.
• Fixed stalled streaming responses timing out instead of falling back to non-streaming mode.
• Fixed 429 retries burning all attempts too quickly by ensuring exponential backoff applies as a minimum.
• Fixed MCP OAuth `oauth.authServerMetadataUrl` configuration override not being honored on token refresh after restart.
• Fixed capital letters being dropped to lowercase in xterm and VS Code integrated terminals when the kitty keyboard protocol is active.
• Fixed macOS text replacements deleting the trigger word instead of inserting the substitution.
• Fixed `--dangerously-skip-permissions` being silently downgraded to accept-edits mode after approving a write to a protected path via Bash.
• Fixed managed-settings allow rules remaining active after an admin removed them until process restart.
• Fixed `permissions.additionalDirectories` changes not applying mid-session; removed directories now lose access immediately.
• Fixed removing a directory from `additionalDirectories` revoking access to the same directory passed via `--add-dir`.
• Fixed `Bash(cmd:*)` and `Bash(git commit *)` wildcard permission rules failing to match commands with extra spaces or tabs.
• Fixed `Bash(...)` deny rules being downgraded to a prompt for piped commands that mix `cd` with other segments.
• Fixed false Bash permission prompts for commands like `cut -d /` and filenames containing `%`.
• Fixed permission rules with names matching JavaScript prototype properties (e.g., `toString`) causing `settings.json` to be silently ignored.
• Fixed agent team members not inheriting the leader's permission mode when using `--dangerously-skip-permissions`.
• Fixed a crash in fullscreen mode when hovering over MCP tool results.
• Fixed copying wrapped URLs in fullscreen mode inserting spaces at line breaks.
• Fixed file-edit diffs disappearing from the UI on `--resume` when the edited file was larger than 10KB.
• Fixed several `/resume` picker issues including uneditable resumes, search state wiping, and transient status text.
• Fixed `/export` not honoring absolute paths and `~`, and silently rewriting user-supplied extensions to `.txt`.
• Fixed `/effort max` being denied for unknown or future model IDs.
• Fixed slash command picker breaking when a plugin's frontmatter `name` is a YAML boolean keyword.
• Fixed rate-limit upsell text being hidden after message remounts.
• Fixed MCP tools with `_meta["anthropic/maxResultSizeChars"]` not bypassing the token-based persist layer.
• Fixed voice mode leaking space characters into input when re-holding the push-to-talk key during transcript processing.
• Fixed `DISABLE_AUTOUPDATER` not fully suppressing the npm registry version check and symlink modification.
• Fixed a memory leak where Remote Control permission handler entries were retained for the entire session.
• Fixed background subagents that fail with an error not reporting partial progress to the parent agent.
• Fixed prompt-type Stop/SubagentStop hooks failing on long sessions.
• Fixed feedback survey rendering when dismissed.
• Fixed Bash `grep -f FILE` / `rg -f FILE` not prompting when reading a pattern file outside the working directory.
• Fixed stale subagent worktree cleanup removing worktrees that contain untracked files.
• Fixed `sandbox.network.allowMachLookup` not taking effect on macOS.
• Fixed `CLAUDE_CODE_MAX_CONTEXT_TOKENS` not honoring `DISABLE_COMPACT` when set.
• Fixed VSCode reporting a false-positive "requires git-bash" error on Windows when the path is correctly configured.