Anthropic · 2026-08-28 · major
Claude Code 2.1.251 — hooks that can block a model switch
Claude Code 2.1.251 adds PreModelSwitch and PostModelSwitch hook events, so a script can block or confirm a model change mid-session. The release also stops file tools following a symlink swapped in after the permission check.
Claude Code 2.1.251 lets a hook step in when the model changes, and closes several symlink and path-traversal holes.
Quick facts
| Maker | Anthropic |
|---|---|
| Version | 2.1.251 |
| Released | 28 August 2026 |
| New hooks | PreModelSwitch and PostModelSwitch |
| New in /cost | Per-session prompt-cache hit ratio, misses and re-cached tokens |
| Binary size | About 5 MB smaller, plus 2.5 MB from dropped syntax highlighting |
| Install | npm i -g @anthropic-ai/claude-code |
What is it?
Two new hook events, PreModelSwitch and PostModelSwitch, land in Claude Code 2.1.251 and let a script block, confirm, or annotate a model change while a session is running. The same release streams a foreground subagent's tool calls and results live to Remote Control clients, and adds a per-session prompt-cache line to /cost.
How does it work?
The hook events fire around the switch itself, so a script can reject the change before Claude continues; SessionStart resume hooks now also receive session staleness and the estimated cost of re-caching. The security work is separate: Read, Write and Edit no longer follow a symlink that was swapped inside the working directory after the permission check ran, Grep and Glob now apply Read deny rules to files reached through a symlinked search path, and a plugin command declared in a marketplace entry can no longer point outside its plugin directory.
Why does it matter?
Teams that pin a model for cost or compliance reasons can now enforce that choice in code rather than trusting each session to stay put. The file-tool fixes matter more day to day: before 2.1.251 a repository could swap a symlink in the gap between the permission check and the file operation, and get the agent to read or write outside the directory the user approved.
Who is it for?
Claude Code users and platform teams
Frequently asked questions
- How do I stop Claude Code from switching models mid-session?
- Claude Code 2.1.251 adds a PreModelSwitch hook event that fires before the model changes. A script bound to that event can block the switch outright, ask for confirmation, or just annotate it, and a matching PostModelSwitch event fires after the change goes through. That gives teams a way to pin a model in code instead of by convention.
- Which plan defaults changed in Claude Code 2.1.251?
- Seat-based Enterprise subscriptions now default to Opus 5 in Claude Code, matching the other premium plans. The release also fixes /usage-credits for Team and Enterprise members whose admin set the organization's usage-credit limit to $0: Claude Code now offers to ask the admin rather than reporting that a cap was reached.
- Does CLAUDE_CODE_SUBAGENT_MODEL still override every subagent?
- No. In Claude Code 2.1.251 the CLAUDE_CODE_SUBAGENT_MODEL variable sets the default subagent model rather than overriding everything. An agent definition's own model: field and an explicit per-spawn model now take precedence over it, so a specialised agent keeps the model it was written for.
- Can project settings still turn on raw API body logging?
- No. Claude Code 2.1.251 stops project settings from enabling detailed beta tracing or raw API body logging, and blocks a lower-scope tracing endpoint from bypassing an OTLP collector pinned by managed settings. Project-level .claude/settings.json can also no longer set CLAUDE_CONFIG_DIR, CLAUDE_CODE_TMPDIR, or TMPDIR.
Try it
npm i -g @anthropic-ai/claude-code@2.1.251