日本語サマリー

Claude Code 2.1.260 リリースノート要約

⚠️ セキュリティ修正・重要な変更

• パーミッション回避の修正：パスに括弧を含む Edit/Write/Read ルールが無効扱いで無視され、「読み取り専用」フォルダが書き込み可能になっていた問題を修正
• Bash 権限チェックの修正：REPORTTIME/REPORTMEMORY/DIRSTACKSIZE 代入にコマンド置換を隠した zsh コマンドが自動承認されていた問題を修正（現在は承認プロンプトが出る）
• 2.1.259 の変更を撤回：Read() deny ルールを Bash 引数に適用する変更が npm run build を拒否するなど過剰だったため revert

主な新機能

• フルスクリーンモードで未コミット変更を表示する diff パネルを追加（/diff で切替）
• /cost とステータスラインの prompt_cache にプロンプトキャッシュミスの推定原因を表示
• headless セッションに /reload-plugins とテキスト版 /advisor を追加
• Claude apps gateway に oidc.scope_on_refresh オプションを追加

主な修正

• 1 つの不正なパターン（閉じられていない [ など）のファイル権限ルールが全編集を失敗させる問題を修正
• Bedrock のモデル探索・トークンカウントが OS の証明書ストアのみの企業ルート CA で失敗する問題を修正
• Claude Fable 5.1 のプロンプトキャッシュがツール結果後のコンテキストに適用されず、毎ターン再送されていた問題を修正
• /rewind がバックアップ欠落時に成功と誤報告する問題、および古いファイル読み取り追跡が残る問題を修正
• model: fable エージェントが [1m] タグを無視して 200K コンテキストで動作する問題を修正
• サブエージェントの 1 時間のバックグラウンドコマンド制限を廃止（メインセッションと同様に終了まで実行）
• GitLab のネストされたサブグループでのリポジトリ検出を修正

その他の改善

• 1M コンテキストモデルの auto-compact を改善（1M トークン直前に圧縮、タイムアウト解消）
• 非対話（-p/SDK）セッションのアイドル時 CPU 使用率を改善
• ctrl+l / cmd+k がフルスクリーンでトランスクリプト表示をクリアするように変更
• 管理対象 CLAUDE.md がセキュリティ承認ダイアログを triggers しないように変更
• [VSCode] エフォートレベル表示、セッション一覧のフィルタ、各種 UI 修正

原文（Release Notes）

What's changed

• Added a diff panel that opens beside the conversation in fullscreen mode and shows your uncommitted changes as Claude edits; toggle it with /diff
• Added a likely cause for prompt-cache misses (e.g. tool definitions or system prompt changed, idle past the TTL) to /cost and the status line's prompt_cache field
• Added /reload-plugins to headless sessions, so it appears in the Claude Code Desktop and SDK command lists
• Added a text form of /advisor (/advisor, /advisor <model>, /advisor off) for the desktop app, Remote Control, and other headless (-p/Agent SDK) sessions
• Added oidc.scope_on_refresh to the Claude apps gateway for IdPs that return an id_token on refresh only when asked for openid again
• Added Claude apps gateway support for newer Claude Desktop keys in desktop policy blocks, including userPluginMarketplacesEnabled and userPluginUploadsEnabled
• Fixed Edit/Write/Read permission rules whose path contains parentheses being dropped as invalid or ignored by the Bash sandbox, which left "read-only" folders writable
• Fixed one file permission rule with an uncompilable pattern (e.g. an unclosed [) making every file edit fail with Invalid regular expression; such a deny rule now guards the literal path it spells
• Fixed Bash permission checks auto-approving zsh commands that hide a command substitution in a REPORTTIME, REPORTMEMORY or DIRSTACKSIZE assignment; these now prompt for approval
• Fixed Bedrock model discovery, token counting and AWS SSO/STS credential calls failing with "unable to get local issuer certificate" when the corporate root CA is only in the OS certificate store
• Fixed permissions.blockReadsOutsideWorkingDirectories on macOS hiding the user's git config from sandboxed git and hiding a worktree-isolated sub-agent's own checkout
• Fixed managed settings not loading for claude.ai Enterprise/Team users who also had a leftover API key from an earlier /login
• Fixed /status listing a signed-in claude.ai account and a configured API key as if both were in effect; the credential not in use is now marked
• Fixed managed skillOverrides entries keyed on a bundled skill's alias (e.g. checkup for /doctor) not applying, and Skill(name) deny rules not covering a nested skill listed as <dir>:name
• Fixed model: fable agents ignoring the [1m] tag on an ANTHROPIC_DEFAULT_FABLE_MODEL pin and silently running with a 200K context window
• Fixed the /model picker not showing Fable 5.1 for organizations that can use it, which was only accepted when typed as /model claude-fable-5-1
• Fixed prompt caching on Claude Fable 5.1 not covering the context attached after tool results, so it was re-sent as uncached input on every tool-call turn
• Fixed model switching staying blocked for the rest of the session after a plugin hook load failure; each switch now re-checks and the refusal names the cause
• Fixed model switching being blocked for the session when an organization-managed plugin's marketplace could not be loaded
• Fixed SDK-provided MCP servers (e.g. Desktop connectors) sometimes missing from the first turn and only appearing on the next one
• Fixed Claude in Chrome tools failing with "Not connected" mid-task in cloud-hosted claude.ai sessions when a connector was added or removed
• Fixed flags, joined emoji and accented letters splitting across wrapped lines, and stale text staying on screen when a flag or joined emoji falls in the terminal's last two columns (now shown as …)
• Fixed Remote Control accepting a model pick that is not a valid model name; it is now refused with an error instead of failing on the next message
• Fixed /rewind and --rewind-files reporting success when checkpoint backup files were missing and nothing was actually restored
• Fixed /rewind leaving stale file-read tracking from the rewound-away turns, which caused "File unchanged since last read" stubs and full-file re-injection after external edits
• Fixed -p --resume/--continue (as used by the desktop app) failing on every retry once a session's worktree directory lost its git metadata; it now fails once, then resumes without the worktree
• Fixed a subagent that resumed another agent via SendMessage never being woken by that agent's completion (the notification went to the main conversation instead)
• Fixed agent teams: an in-process teammate's transcript losing messages, or going blank, during long API retry waits (e.g. under CLAUDE_CODE_RETRY_WATCHDOG) as retry notices evicted real messages
• Fixed a session that moved to the background appearing twice in ListAgents (once as a phantom "interactive" twin with the same name) and receiving SendMessage deliveries in the viewer
• Fixed intermittent "task output swap refused" errors when many sessions share a project directory
• Fixed Ctrl+Z in fullscreen leaving the shell on the alternate screen, drawn over the paused interface
• Fixed Workflow tool subagents being restarted as stalled while a long context compaction was still in progress
• Fixed plugins from a URL marketplace failing to install with "marketplace entry path does not stay inside the marketplace directory" when a host app (e.g. Claude Desktop) stores it as a directory
• Fixed an extra browser tab opening when an artifact is published in a session you're driving from claude.ai, the desktop app, or mobile (Remote Control)
• Fixed the Artifact tool's first call failing with an "Invalid tool parameters" validation error in some Cowork sessions
• Fixed IDE line selections being dropped when running a skill or slash command (the "N lines selected" context now reaches Claude)
• Fixed repository detection for GitLab projects in nested subgroups (e.g. gitlab.com/group/subgroup/project)
• Fixed owner/repo#123 issue references in rendered output linking to github.com when working in a GitLab repository; they now link to the gitlab.com issue
• Glob/Grep: Fixed the search path being probed on disk before the permission check; a missing path is now reported after permission is decided, as Read does
• Reverted the 2.1.259 change applying Read() deny rules to Bash arguments; it denied npm run build under a Read(./**/build/**) rule in every mode and made cd … && grep prompt even in auto mode
• Improved structured output: Workflow agent({schema}) rejects a JSON Schema that can never be satisfied up front, and retry-cap errors now include the last validation failure
• Improved deleting a background session whose worktree has unpushed commits: the message now names the branch and commit count, and deleting again discards the worktree
• Improved the Claude apps gateway's refresh-failure log to name the step that failed
• Improved idle CPU usage of non-interactive (-p / SDK) sessions
• Improved the Claude apps gateway on Amazon Bedrock: input tokens for an aborted request are now counted with AWS's free CountTokens API (grant bedrock:CountTokens) instead of a one-token request
• Improved the settings error for rules such as Edit(C:\dir\(name)\**), where \( is read as an escaped parenthesis rather than a path separator, to suggest an unambiguous spelling
• Improved auto-compact for 1M-context models: Opus and Fable sessions now compact shortly before the 1M-token limit, and recovery compaction on very large contexts no longer times out at 10 minutes
• Improved /ultrareview and claude ultrareview to wait up to 45 minutes (previously 30) for long-running cloud reviews
• Improved /effort on Claude Fable 5.1 so changing effort mid-session no longer invalidates the prompt cache
• Updated the bundled claude-api skill so its Go, Java, and C# samples use current-generation model IDs, and clarified that cheaper worker or sub-agent models should be current-generation too
• Changed ctrl+l / cmd+k in fullscreen mode to clear the transcript view like a terminal clear; scroll up to see earlier messages
• Changed permission rules with text after the closing parenthesis (e.g. Bash(ls) x), which never matched anything, to be reported as invalid settings instead of being silently ignored
• Changed server-managed settings so a managed CLAUDE.md (claudeMd) no longer triggers the security approval dialog; hooks, shell-command, sandbox, and unsafe env settings still require approval
• Changed Claude in Chrome to follow your organization's Claude in Chrome admin setting; when an admin turns it off, --chrome, /chrome and the browser tools are unavailable
• Changed Claude apps gateway to send orgPluginSettings in the list form read by Claude Desktop 1.15200.0 and later; older desktops ignore it
• Changed Claude apps gateway to also refuse to start, naming the field, when a desktop policy misspells a field in a nested object of a managedMcpServers or orgPluginSettings entry
• Changed commands typed at the ! bash-mode prompt to run outside the sandbox even when strict sandbox mode (sandbox.allowUnsandboxedCommands: false) is on, like typing into your own terminal
• Changed self-hosted runner --kill-session-after-min to release a session that is only waiting on its user (paused, resumable on the next message) instead of killing it and reporting a failure
• Removed the one-hour time limit on background commands started by subagents; they now run until they exit or are stopped, matching the main session
• [VSCode] Added the selected effort level to the footer model pill, fixed a stale effort level after switching models, and returned the footer pills to their earlier compact size
• [VSCode] Added Open and Closed to the session list's status filter menu
• [VSCode] Fixed the welcome screen disappearing in a new session when Remote Control turns on automatically
• [VSCode] Fixed the session history picker loading a session a second time when it is already open in another tab; it now switches to that tab
• [VSCode] Fixed the session tab's Rename command silently doing nothing while the tab's view was reloading; it now always applies
• [VSCode] Fixed a half-finished message, an empty tool card or an extra "Thought for" line staying on screen after Claude Code retried a dropped response
• [VSCode] Fixed "Enable Remote Control for all sessions" not applying to a session tab that was still starting when the toggle was flipped