Claude Code v2.1.257: Claude Fable 5.1, Time Format Settings, and New Auto Mode Safeguards

Claude Code v2.1.257 is a large release with 104 changelog entries. It adds Claude Fable 5.1 as the default Fable model, new time format and time zone settings, and new auto mode safeguards, including a Containment Escape rule. It also changes how several permission-related settings behave, fixes a long list of permission, subagent, background session, and prompt-cache issues, and brings a set of VS Code updates.

What’s New

Claude Fable 5.1 Is the Default Fable Model

Claude Fable 5.1 (claude-fable-5-1) is added and is now the default Fable model, with a 1M context window and pricing of $10/$50 per Mtok plus $0.25/Mtok for cache reads. In Claude apps gateway sessions, fable and best keep resolving to Fable 5 for now, because gateways not yet configured for Fable 5.1 reject it; pick Fable 5.1 in /model to use it there.

Time Format and Time Zone Settings

New “Time format” (timeFormat) and timeZone settings control the turn-end clock and transcript-view timestamps, with options for 12-hour, 24-hour, 24-hour UTC, or a strftime pattern.

Auto Mode Safeguards

A new Containment Escape rule means cloud metadata-credential fetches, egress evasion, and cross-tenant reach are no longer auto-approved unless your environment marks them as expected.
Auto mode now shows a one-time prompt before the first file read outside the working directories, with the option to block such reads (permissions.blockReadsOutsideWorkingDirectories).
In Cowork and claude.ai cloud sessions, reading an artifact that isn’t yours now always asks you first, even in auto mode.

Subagent Model and Effort Controls

CLAUDE_CODE_SUBAGENT_MODEL_FORCE applies CLAUDE_CODE_SUBAGENT_MODEL (or the main model) to every subagent, ignoring per-spawn and agent-definition model overrides.
In /effort, s changes effort for the current session only, matching /model.
--effort now lifts a new model’s default-effort hold for that session only rather than permanently, and an effort picked on claude.ai for a Remote Control session now applies during the hold.

Settings and Behavior Changes

defaultMode: "bypassPermissions" in .claude/settings.json or .claude/settings.local.json is now ignored, like "auto"; set it in user or managed settings, or pass --permission-mode.
--add-dir, /add-dir, and additionalDirectories now refuse network paths (UNC shares, /net/<host> automounts) with a message before touching them; on Windows, use a mapped drive letter.
/btw history browsing moved from ←/→ to Shift+←/Shift+→ (or [/]), stepping through your recent side questions and back to the live answer.
claude --resume <session-id> --bg now continues that session under its own ID when nothing is running it, instead of silently starting a copy; when a copy is started, it is now announced.
The Ctrl+E command explanation on Bash and PowerShell permission prompts was removed.

Gateway Model Discovery

Discovered /model picker entries can now show a gateway-supplied description (CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY); entries without one still read “From gateway”. Gateway model discovery (CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1) now also runs when CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC is set, since it only queries your gateway.

VS Code

The session list panel adds collapsible ACCOUNT & USAGE and SESSION MANAGER section headers, showing the account email, the usage meter, and a View details link that opens the usage dialog; the Ungrouped section also gets a collapse toggle.
A model pill in the input footer shows the current model and opens the model picker, with an Effort row and a “More models” page.
The command menu now includes output style selection, including custom styles.
“Delete session” is now “Archive session”: archived sessions move to a collapsible “Archived sessions” group at the bottom of the list, with an Unarchive action.
The action menu now lists slash commands in a filterable “Slash commands” dialog instead of inline, and picking one runs it; the MCP servers dialog gained the same filter box.

Fixes and Improvements

Permissions and security

Plugins can no longer read files outside their own directory through a declared command, agent, skill, hooks, or other component path that is a symlink; such paths are now refused with an error.
Bash Read()/Edit() deny rules now apply to < file redirects and to reader commands like tac and egrep; a deny rule on any argument or redirect target now refuses the command.
A permissions.ask rule is no longer skipped in auto mode when the matching command runs inside a compound command or subshell.
Bash permission checks no longer auto-approve certain [[ ]] conditionals that zsh parses differently from bash; these commands now prompt for approval.
Dismissing the Remote Control consent prompt (Esc, or n at claude remote-control) no longer counts as consent.

Subagents and background sessions

Subagents whose response is cut off mid-stream by computer sleep, a dropped connection, or a server error now continue automatically instead of ending with an incomplete response.
Resuming or messaging a subagent whose transcript has grown past 5 MB (for example, after reading many images) no longer fails with “No transcript found”.
Background commands that detach from their shell (for example under timeout or setsid) no longer survive a task stop or Claude Code exit.
--resume no longer lists a backgrounded conversation twice, and --continue no longer reopens its stalled pre-background copy; --continue now also opens finished background sessions.

Prompt cache and performance

Sessions with an advisor model set no longer miss the prompt cache on background requests (compaction, /recap, prompt suggestions) and re-send the full conversation uncached each time.
Long screenshot-heavy sessions no longer miss the prompt cache on every turn once images exceed the per-request size cap.
/fork now keeps the original conversation’s prompt cache in the new background session; its worktree briefing arrives as a message instead of a system-prompt change.
Rendering is lighter: less re-render work per turn in long conversations, streaming no longer slows down as the reply grows, and background-agent updates no longer re-render the whole screen. Prompt input is also more responsive thanks to less per-keystroke rendering work.

Providers and gateways

Bedrock and Bedrock Mantle requests no longer go silent during long hidden-thinking phases on Opus 4.7 and later, which had let idle timeouts cut the connection; the stream now carries progress events.
A leftover Anthropic API key or auth token is no longer sent alongside your Foundry subscription key in API-key mode.
Claude apps gateway sign-in and token refresh requests now verify the gateway’s pinned TLS certificate, as the managed settings fetch already does.

CLI and tools

/code-review --comment now posts findings on GitLab merge requests via glab mr note instead of reporting the target as unsupported.
claude -p no longer exits about 5 seconds after its final result while a Monitor the model armed is still running; it now waits for the watch to fire or time out.
Settings in a .claude/ folder created after startup are now picked up without a restart.
/doctor now warns about stale sandbox mask files left by a killed session.

v2.1.257 contains 104 changes in total; see the full changelog for the complete list.

How to Update

Check your installed version: claude --version
Update in place: claude update
If a project’s .claude/settings.json or .claude/settings.local.json sets defaultMode: "bypassPermissions", that setting is now ignored; if you still need it, set it in user or managed settings, or pass --permission-mode.