Claude Code v2.1.196: Org Default Models, Security Fix, Background Job Recovery

Claude Code v2.1.196 ships with a security fix for .mcp.json server spawning, organization default models, and a raft of reliability improvements for background agents and sessions. Key changes below.

Org Default Models

Admins can now set an organization default model in the Anthropic console. When no model is explicitly chosen, /model displays "Org default" (or "Role default" if assigned). During session start, readable default names are also added for easier identification.

Security: MCP Spawning Locked Down

claude mcp list and claude mcp get no longer spawn .mcp.json servers that a repo self-approved via a committed .claude/settings.json. Untrusted workspaces now show ⏸ Pending approval until the user explicitly grants permission.

Background Session Recovery

Long-running commands and workflows now survive process stops, restarts, or updates. On Windows, background shells are handed off instead of killed. Workers killed by a daemon restart automatically resume from where they left off when the agents view reopens. For Remote sessions, a server restart no longer loses mid-turn state — sessions auto-resume on the next worker.

A critical fix: waking a background job previously deleted its conversation and re-ran the original prompt if the transcript probe misread the file. That file is now set aside, never deleted.

Streaming Idle Watchdog Enabled by Default

The streaming idle watchdog is now on for all providers. It aborts and retries when a response stream produces no events for 5 minutes. Set CLAUDE_ENABLE_STREAM_WATCHDOG=0 to disable.

Other Notable Fixes

• Rate-limit telemetry: fixed flickering warning and over-counting when multiple parallel requests hit a usage limit simultaneously.
• Duplicate recap lines: schema-rejected StructuredOutput attempts no longer render alongside their retry.
• PowerShell git commands: git diff, git grep, egrep/fgrep, and quoted patterns containing | exiting with code 1 are no longer reported as failures — matches Bash behavior.
• Claude agents side panel: keyboard focus no longer stuck when opening an agent; background jobs now retain subagent types; session status shows correct labels — completed rows no longer flip between "Done" and "Needs your input", stalled agents show "Needs attention", and results with a PR show a clickable link.
• --dangerously-skip-permissions: now shows the bypass disclaimer and applies bypass mode to spawned agents instead of silently falling back to auto.
• /code-review token usage: merged five cleanup finders into one, cutting tokens by roughly 25%.
• Performance: reduced per-frame rendering work by skipping no-op subtree walks during streaming.
• Agents view navigation: opening from a foreground session now requires a single ← press instead of two.
• Voice dictation: no longer swallows spaces or spuriously starts recording during fast typing when voice mode is on.