Claude Code v2.1.251: New Model-Switch Hooks and a Spend Limit Bar Arrive!

Hi, it's Shii-chan! Today I dug into Claude Code's latest release, v2.1.251. It's a quiet one on the surface, but it's packed with hook-related features and security fixes that really matter.

Claude Code Release github.com

What was announced?

This comes from Claude Code Release (the GitHub Releases page). Published on August 28, v2.1.251 bundles new hook events that let you intervene in model switches, better visibility into cost management, and a handful of important, if unglamorous, security fixes.

The story so far

Until now, Claude Code had no way to hook into the moment a model switches automatically, so you couldn't block it or ask for confirmation. Background subagents only showed status, not what they were actually doing in real time, and /usage had no way to visualize a spend limit. On top of that, file tools had a gap: if a symlink inside the working directory got swapped out right after the permission check passed, it could let you read or write outside the directory you had approved.

What changes

With this release, you can now control model-switch behavior with your own hooks. The new PreModelSwitch and PostModelSwitch hook events let you block, confirm, or annotate a switch. SessionStart resume hooks now also receive the session's staleness and the estimated cost of re-caching it.

If you are behind a Claude apps gateway with spend limits, /usage now shows a spend limit bar, and status line scripts can read the same value from a new rate_limits.spend_limit field. /cost now also shows a per-session prompt-cache line: hit ratio, misses, tokens re-cached, and the warm/cold breakdown.

On top of that, a foreground subagent's tool calls and results now stream live to Remote Control clients (background subagents, still the default, continue to show status only). It is a small thing, but it makes it much clearer what is actually happening when you are running multiple agents at once.

On the security side, the symlink-swap gap after the permission check has been closed. A related issue where a plugin's marketplace-declared commands could point outside the plugin directory is now rejected with a path-traversal error.

Dive Deep

This release has a lot of fixes and improvements, so here is a rundown by category.

New features and visibility:

• claude --help now lists attach, logs, stop, respawn, and rm. The resume message for a running background session now names the exact attach command to use
• Grep and Glob now correctly apply Read deny rules to files reached through a symlinked search path

Security and permission fixes:

• Fixed project settings being able to enable detailed beta tracing or raw API body logging, and a lower-scope beta tracing endpoint bypassing an OTLP collector pinned by managed settings or a host app
• Fixed the Workflow tool reading, and quoting in error messages, a scriptPath outside what the session may read, before the permission check ran
• Server-managed settings that terminate sandbox TLS, route sandbox traffic through your own proxy, inject credentials, or weaken sandbox isolation now require approval before they apply
• ANTHROPIC_CUSTOM_HEADERS from managed or project settings now requires approval when it sets a credential, org/tenant, routing, or API-behavior header, such as Authorization or Host

Other improvements:

• Smaller install size: the native binary is about 5 MB smaller, plus another 2.5 MB saved by dropping syntax highlighting for six rarely used languages
• Fixed SDK and cloud sessions hanging indefinitely when an SDK MCP server's handshake acknowledgment was lost; the wait now times out after 70 seconds and marks only that server as failed
• Improved CPU usage during turns in interactive sessions by cutting redundant UI re-renders
• Changed the default model for seat-based Enterprise subscriptions to Opus 5, matching other premium plans

Wrap-up

• New PreModelSwitch / PostModelSwitch hooks let you control model switches
• /usage gets a spend limit bar, and /cost gets a per-session prompt-cache line
• A foreground subagent's tool calls now stream live to Remote Control
• Several quiet but important security gaps were closed, including symlink swaps and plugin path traversal
• Smaller everyday improvements too, from claude --help to install size

This update is especially worth a look if you want fine-grained hook control, if your team tracks cost and cache efficiency closely, or if you are running multiple agents in parallel.