PreModelSwitch hooks tighten model-switch control; symlink vulnerabilities patched — security & transparency simultaneously
Claude Code v2.1.251 — Model Switch Hooks, Cache Status Tracking, Security Fixes
Original: v2.1.251
Importance: Claude Code の重要なフック API 追加・セキュリティ脆弱性修正・プロンプトキャッシュ可視化により、開発者の制御性と安全性が大幅向上
Summary
Claude Code v2.1.251 adds PreModelSwitch and PostModelSwitch hook events for validating, blocking, or annotating model switches. Introduces per-session prompt-cache tracking in `/cost` (hit ratio, misses, re-cached tokens, warm/cold status). Security patches fix symlink traversal in file tools (Read/Write/Edit), plugin commands pointing outside plugin directory, Workflow tool reading outside permitted paths, and Grep/Glob symlink bypass issues. UI improvements include live streaming of foreground subagent tool calls to Remote Control clients, TUI lag reduction with many parallel subagents, and fixes for agent team final answer delivery and background subagent messaging.
Key Points
- PreModelSwitch/PostModelSwitch hooks enable validation, blocking, annotation of model switches
- Per-session prompt-cache stats in /cost (hit ratio, misses, re-cache cost) — precise cost optimization
- Symlink traversal security fixes in file tools, Workflow — multiple vulnerability patches
- Live streaming of foreground subagent tool calls to Remote Control clients — UX improvement
- Agent team responses, background session messaging, TUI lag — stability and usability fixes
View developer notes (APIs, breaking changes, migration)
v2.1.251 exposes PreModelSwitch/PostModelSwitch hook events — plugins/users can block/confirm/annotate model_id switches. SessionStart resume hooks now carry session_staleness (estimated) and estimated_re_cache_cost. `/cost` endpoint adds prompt_cache object with hit_ratio, misses, tokens_recached, cache_type (warm/cold). Status-line scripts gain rate_limits.spend_limit field. Security: symlink traversal fixes in file tools (Read/Write/Edit checks now post-permission), Grep/Glob apply Read() deny rules through symlinked paths, plugin commands reject path-traversal, Workflow scriptPath permission check moved before read. Opus 5 effort handling fixed — when thinking=disabled, effort sent as 'high' instead of failing 'not supported'. No breaking changes.
Source: https://github.com/anthropics/claude-code/releases/tag/v2.1.251
Outlet: Claude Code Releases
This article is an AI-generated summary (OpenAI GPT-4o-mini) of publicly available information from Anthropic, OpenAI, Google, Meta, Mistral, DeepSeek, Sakana, and other vendors. The original source URL is always provided in accordance with fair-use citation requirements. Summaries are AI-generated and may contain mistranslations or misinterpretations. Always verify details with the original source.