Claude Code 2.1.251 turned a cost guarantee into a suggestion, and fixed a symlink that escaped the approved directory

Two things in one release, and only one of them is in the security section.

CLAUDE_CODE_SUBAGENT_MODEL used to override the model for every subagent. In 2.1.251 it sets the default instead. An agent definition's model: frontmatter now wins, and so does an explicit per-spawn model. (Claude Code Changelog)

If you set that env var to pin every subagent to a cheap model for cost control, and any of your agent definitions declare their own model, that guarantee is gone and nothing told you. The env var still exists. It still parses. It just lost an argument it used to win. This is the failure mode I hate most in config changes, because there's no error, no warning, and no observable difference until the invoice.

Go grep .claude/agents/*.md for model: frontmatter. That's the whole check. Every file that declares a model is now ignoring your env var.

The security half of the same release: Read, Write and Edit would follow a symlink swapped inside the working directory after the permission check ran, reaching outside the approved location. Classic TOCTOU. Grep and Glob separately weren't applying Read(...) deny rules through a symlinked search path. (GitHub)

Four codebases hit the same bug class in 48 hours. gemini-cli made workspace trust fail-closed, because a trust-check failure previously produced a trusted workspace. SiYuan's CVE-2026-82234 resolved DNS at guard time and never re-checked at connect time, leaving DNS rebinding open to cloud metadata. Codex 0.151.0 stopped stale Guardian classifications from authorizing actions after permission state changed. Claude Code fixed the symlink swap and a Workflow tool that read a scriptPath outside permitted scope before the permission check, then echoed the contents into an error message.

One shape underneath all four: the guard evaluated a name, or a resolution, that was still mutable when the access actually happened. If you write tool-permission code, the test isn't "is this path allowed." It's "is this the same object I checked."

The same release adds a /cost line reporting per-session prompt cache hit ratio, misses, tokens re-cached, and warm against cold, plus a matching prompt_cache object for status line scripts. This arrives one release after the fix for Claude Code blowing its own cache hourly on OAuth token refresh, which is the argument for it: cache behavior was invisible, so that regression could run for weeks unnoticed. Pull prompt_cache into your status line and the next one becomes a tripwire instead of a bill.

Also in 2.1.251: PreModelSwitch and PostModelSwitch hooks that can block or annotate a model switch, and SessionStart resume hooks now receive session staleness plus estimated re-cache cost. That second one is the useful half for scheduled agents. A resume hook can now decide whether reviving a stale session is worth the cache rebuild instead of guessing. (Releasebot)