Claude Code v2.1.251 adds model-switch hooks, live streaming of subagent tool calls, and spend-limit UI

Anthropic released Claude Code v2.1.251, a tool-focused update that adds developer-facing features and bug fixes. The changelog lists new hook events for model switches, live streaming of foreground subagent tool calls to Remote Control clients, and a spend-limit bar in the /usage interface for sessions managed behind a Claude apps gateway.

Two new hook events, PreModelSwitch and PostModelSwitch, allow hosts or plugins to block, confirm, or annotate a model switch during a session. SessionStart resume hooks now receive session staleness and an estimated re-cache cost, providing additional context for session recovery.

Foreground subagent tool calls and their results are streamed live to Remote Control clients, while background subagents continue to show only status updates. A spend-limit bar is now visible in /usage, and a rate_limits.spend_limit field is exposed for developers behind a Claude apps gateway with spend limits configured.

Per-session prompt-cache metrics are added to /cost, including hit ratio, misses, tokens re-cached, and warm/cold status. A matching prompt_cache object is available for status-line scripts. The CLI help text now includes attach, logs, stop, respawn, and rm commands, and the --resume message for a running background session names the exact claude attach <id> command to reattach.

The release also fixes several security and stability issues. File tools (Read, Write, Edit) no longer follow symlinks swapped inside the working directory after permission checks, preventing potential out-of-bounds reads or writes. Plugin commands declared in a marketplace entry can no longer point outside the plugin directory, and project settings can no longer enable detailed beta tracing or raw API body logging when restricted by managed settings.

Additional fixes address session management and agent workflows. Workflow tool no longer reads or quotes a scriptPath outside the session's approved read scope. Grep and Glob now apply Read(...) deny rules to files reached through a symlinked search path. Conversations no longer get stuck on "text content blocks must be non-empty" errors after a turn where the model produced only thinking content.

Background session issues are resolved, including correct initialization in auto mode for fresh installs when the account's startup default is auto, and proper delivery of SendMessage to a session via Claude Desktop. TUI lag with many parallel subagents is reduced by replacing per-second progress ticks instead of piling them up in the transcript.

Agent teams now correctly forward a teammate's final answer to the team lead via the idle notification, and background subagents can reply to messages from unnamed siblings or parents. Managed settings that disable auto mode mid-session now properly transition an already-running auto-mode session back to default mode.

Operational reliability is improved with fixes for model-effort mismatches when thinking is disabled, correct model-change reporting in cloud sessions, and quiet notices for Remote Control when an organization's policy disables it. The /mcp reconnect command now shows the real remedy instead of a generic withheld-detail error when a server was disabled in another session.

CLI and session stability are enhanced with fixes for client-injected assistant tool calls in --input-format stream-json, transcript overwrites during directory relocations, and background sessions' inability to edit files inside a git worktree they created. Session startup race conditions in plugin marketplace refreshes and tmux copy behavior over SSH are also corrected.

SDK and cloud sessions no longer hang indefinitely when an SDK MCP server's handshake acknowledgment is lost, timing out after 70 seconds. Force-stopped sessions no longer leave stuck Bash tool processes from the runner, and /usage-credits now offers to ask the admin when an org's usage-credit limit is set to $0. Git fetch logic is corrected for --worktree --tmux with a merge-request number on gitlab.com origins, and editor-specific issues like Ctrl+G in emacs -nw are resolved.

Input validation is tightened to prevent crashes from additionalDirectories entries containing a null byte, and the MCP server menu's copy action is fixed.