Claude Code 2.1.251 patches a symlink escape in its file tools
The 71-change drop also adds model-switch hooks, a --restricted sandbox flag, live subagent streaming, and clearer spend and cache accounting.
Copy markdown
Swapped symlinks can't escape the working dir
Read, Write, and Edit now block symlinks swapped to point outside your working directory, closing a path-escape hole. Worth the upgrade if you point Claude Code at untrusted repos or run it in --restricted mode.
PreModelSwitch / PostModelSwitch hooks
New hook events let you block, confirm, or annotate a model switch, so an accidental jump to Opus 5 mid-task, or an unwanted switch in CI, is now gateable. SessionStart resume hooks also receive session staleness and the estimated re-cache cost.
--restricted strips Bash, exec, and WebFetch
Landed in 2.1.248, the --restricted flag removes the built-in Bash, code-execution, and WebFetch tools while keeping file tools scoped to the working directory. A one-flag sandbox for turning an agent loose on a repo you don't fully trust.
Spend and cache, finally visible
/usage now shows a spend-limit bar for gateway users plus a per-loop breakdown, and /cost adds per-session prompt-cache analytics. Easier to see which loop or cache miss is eating your token budget.
Watch subagents from Remote Control
Foreground subagent tool calls now stream live to Remote Control clients, so you can follow parallel agents from a cloud or remote session instead of only the local terminal.
Elsewhere: Gemini 3.5 Transcribe hits GA
Google shipped two dedicated speech-to-text models, gemini-3.5-transcribe and a live streaming variant, with utterance-level language detection across 85+ languages. A cheap building block for voice input and meeting-notes tools.