Claude Code v2.1.251: Model Switch Hooks, Spend Limit Bar, and Security Fixes

Claude Code v2.1.251 is out with several new capabilities and a batch of security fixes. Highlights include model-switch hooks, live subagent streaming to Remote Control, a Spend limit bar, and patches for file-tool symlink and plugin path traversal vulnerabilities.

Model Switch Hooks and Session Start Enhancements

Two new hook events let you intercept model changes: PreModelSwitch and PostModelSwitch. These allow blocking, confirming, or annotating a switch. Additionally, SessionStart resume hooks now receive session staleness and the estimated re-cache cost, giving you more context when a session resumes.

Live Subagent Streaming to Remote Control

Foreground subagents' tool calls and results now stream live to Remote Control clients. Background subagents (the default) still show status only. This is useful for debugging when you need to see exactly what a subagent is doing in real time.

Spend Limit Bar and Cache Stats

For teams behind a Claude apps gateway with spend limits, /usage now displays a Spend limit bar. Status line scripts can access rate_limits.spend_limit. Also, /cost now shows a per-session prompt-cache line (hit ratio, misses, tokens re-cached, warm/cold) and a matching prompt_cache object for status line scripts.

CLI Help Improvements

claude --help now includes attach, logs, stop, respawn, and rm commands. The --resume message for a running background session now names the exact claude attach <id> command to use.

Security Fixes

This release addresses several security issues:

• File tools (Read, Write, Edit) no longer follow a symlink swapped inside the working directory after the permission check, preventing reads/writes outside the approved location.
• Plugin commands declared in a marketplace entry can no longer point outside the plugin directory; such paths are rejected with a path-traversal error.
• Project settings can no longer enable detailed beta tracing or raw API body logging, and a lower-scope beta tracing endpoint can no longer bypass an OTLP collector pinned by managed settings or a host app.
• The Workflow tool now checks permissions before reading a scriptPath outside the session's allowed scope.
• Grep and Glob now apply Read(...) deny rules to files reached through symlinked search paths.

Bug Fixes and Improvements

Other notable fixes:

• Fixed conversations getting stuck on "text content blocks must be non-empty" errors after a turn with only thinking.
• First launch on fresh install now respects auto mode default.
• Opus 5 requests with effort xhigh/max and thinking disabled now send effort as high.
• Replying to a message from another Claude Desktop session now delivers correctly.
• TUI lag with many parallel subagents is reduced: per-second progress ticks replace their predecessor instead of piling up.
• Agent teams: a teammate's final answer now reaches the team lead via the idle notification.
• Background subagents can now reply to messages from unnamed sibling or parent agents.
• Managed-settings disableAutoMode arriving mid-session now correctly switches back to default mode.
• Fixed misleading tip to switch to Opus 1M when current model already has 1M context.
• Gateway sessions no longer treat stored Anthropic profile as active.
• Remote Control no longer reports failure when disallowed by policy — shows a quiet notice.
• /mcp reconnect on Remote Control shows real remedy instead of generic error.
• Fixed --input-format stream-json losing results when assistant tool calls lack message id.
• Session transcripts no longer silently overwritten when directory change relocates session.
• Background sessions can now edit files inside a git worktree they created.
• Fixed background sessions starting without plugin skills when another process refreshes marketplace.
• Text selection in tmux over SSH copies to tmux buffer like foreground sessions.

Full details and download links are in the official release notes.