TL;DR

• The streaming idle watchdog is now on by default for all providers. It aborts and retries when a response stream goes silent for 5 minutes; set CLAUDE_ENABLE_STREAM_WATCHDOG=0 to disable if you hit false positives. (more below)
• claude mcp list/get no longer auto-spawn servers from untrusted workspaces. If a repo self-approved MCP servers via a committed .claude/settings.json, they now show ⏸ Pending approval instead of launching silently.
• --dangerously-skip-permissions was silently falling back to auto mode. It now shows the bypass disclaimer and applies bypass mode to spawned agents as documented.
• MCP OAuth no longer requests the full scopes_supported catalog when no scope is specified. If you were hitting invalid_scope failures on GitLab self-hosted or enterprise IdPs, this is the fix.

New in 2.1.196

2.1.196 (June 30, 2026)

• Added support for organization default models; admins set it in the org console, and it shows as "Org default" (or "Role default") in /model when you haven't picked one yourself
• Added readable default names for sessions at start, making them easier to identify and message
• Added clickable file attachments in chat; Cmd/Ctrl-click reveals the file in Finder/Explorer
• Security: claude mcp list/get no longer spawn .mcp.json servers that a repo self-approved via a committed .claude/settings.json; untrusted workspaces show ⏸ Pending approval
• Fixed waking a background job permanently deleting its conversation and re-running the original prompt when the transcript probe misread a real transcript; the file is now set aside, never deleted
• Fixed the rate-limit warning flickering off and rate-limit telemetry being over-counted when multiple parallel requests were in flight at the moment a usage limit was hit
• Fixed duplicate recap lines after a background session's turn: a schema-rejected StructuredOutput attempt no longer renders alongside its retry
• Fixed PowerShell git diff/git grep, egrep/fgrep, and quoted search patterns containing | being reported as failures when they exit 1, matching Bash behavior
• Fixed multiple claude agents side panel issues: keyboard focus getting stuck when opening an agent, background jobs losing their subagent types on every open, and sessions showing incorrect status while actively running
• Fixed claude agents --dangerously-skip-permissions silently falling back to auto mode instead of showing the bypass disclaimer and applying bypass mode to spawned agents
• Fixed mid-turn crash recovery for Remote sessions; sessions interrupted by a server restart now auto-resume on the next worker
• Fixed sessions moved with /cd reappearing in the old directory's resume list after a non-graceful exit when the old path contained special characters
• Fixed claude plugin validate skipping local plugins whose source is "." and stopping after the first error class
• Fixed Esc Esc at an idle prompt not opening the rewind menu (regression); use Ctrl+C or Ctrl+X Ctrl+K to stop background agents
• Fixed MCP OAuth requesting the authorization server's full scopes_supported catalog when no scope is specified, causing invalid_scope failures on GitLab self-hosted and other enterprise IdPs
• Fixed /context showing 0 tokens for all tool groups on Bedrock
• Fixed /deep-research misreporting verifier failures as "all claims refuted" instead of unverified
• Fixed plugin dependency version pins not being honored when the marketplace was added as a local folder path backed by a git repo
• Fixed claude agents session status: completed rows no longer flip between "Done" and "Needs your input", stalled agents are now labeled "Needs attention", and results that mention a PR show a clickable link
• Fixed voice dictation swallowing spaces and spuriously starting a recording during very fast typing when voice mode is enabled
• Improved background session reliability: long-running commands and workflows now survive the session's process being stopped, restarted, or updated, including on Windows, where background shells are handed off instead of being killed
• Improved background agents: workers killed by a daemon restart are now automatically resumed from where they left off the next time the agents view opens
• Improved /code-review workflow: merged five cleanup finders into one, cutting token usage by roughly 25%
• Reduced per-frame rendering work in the terminal UI by skipping no-op subtree walks during streaming
• The streaming idle watchdog is now on by default for all providers. It aborts and retries when a response stream produces no events for 5 minutes. Set CLAUDE_ENABLE_STREAM_WATCHDOG=0 to disable.
• Remote Control is now disabled when ANTHROPIC_BASE_URL points at a non-Anthropic host, matching the existing behavior under CLAUDE_CODE_USE_BEDROCK/_VERTEX/_FOUNDRY
• Changed opening the agents view from a foreground session to require a single left-arrow press instead of two, matching the behavior in background sessions

Notes