Claude Code 2.1.257-258: Fable 5.1, and a warier auto mode

Two releases since the last digest, 2.1.257 and 2.1.258, both shipped on September 1. The first is a big one, over eighty entries. The second is two fixes. The thread running through the big release isn't one standout bug, it's the same idea showing up three times: an action that used to slip through quietly now gets stopped, because the context it runs in matters as much as the action itself.

Fable 5.1, and cache reads four times cheaper

Claude Fable 5.1 (claude-fable-5-1) is now what the Fable alias resolves to, replacing Fable 5. One clarification up front: the model docs are explicit that no Fable model is the default model on any plan, you still have to pick it yourself in /model. What changes here is only which version you get once you do.

It keeps the same 1 million token context window as Fable 5, Sonnet 5, and Opus 4.6 and later, and requires Claude Code 2.1.255 or newer. On pricing, the pricing page confirms input and output stay identical to Fable 5, at $10 and $50 per million tokens, but cache reads drop to $0.25 per million against $1 on Fable 5, four times cheaper. If you run an agent that reads back a lot of cached context, that's the line that moves on your bill, not the base input price, which is unchanged.

One detail if you go through a Claude apps gateway: the fable and best aliases keep resolving to Fable 5 for now, because gateways not yet configured for Fable 5.1 reject it. Pick Fable 5.1 explicitly in /model to get it.

Auto mode grows wary of the cloud and of your own project files

Three changes in 2.1.257 share the same logic. First, a new Containment Escape rule joins the auto mode classifier: fetching credentials from a cloud metadata service, evading network egress filtering, or reaching into another tenant are no longer auto-approved by default. That's the classic playbook a compromised agentic pipeline uses to steal the host machine's credentials and pivot elsewhere. Your environment can mark these actions as expected if it genuinely needs to, but that's no longer the default.

Second, auto mode now shows a one-time prompt the first time a session reads a file outside the working directories, with the option to block that kind of read entirely via permissions.blockReadsOutsideWorkingDirectories. A session quietly widening its read scope no longer goes unnoticed.

Third, and this is the one most likely to break an existing setup: setting defaultMode: "bypassPermissions" in a project's .claude/settings.json or .claude/settings.local.json is now ignored, the same way "auto" already was. The permission modes doc confirms it plainly: the session starts in Manual mode instead. You now have to set that value in user or managed settings, or pass --permission-mode. If a repo you cloned configured this for the whole team, that project file just lost the power to do so: anyone with write access to the repo could until now grant themselves a full permissions bypass just by committing a line of JSON.

Two isolation leaks closed

Two fixes in the same release close older gaps. The first is in the sandbox: a domain written with a trailing dot, like example.com., wasn't blocked by a deniedDomains rule even though it names the same host in DNS, and "don't ask again" on such a host kept prompting anyway. The second sits elsewhere: a plugin declaring a command, agent, skill, or hook whose path is a symlink could read files outside its own directory; those paths are now rejected with a directory traversal error, the same kind of fix already seen on file tools in 2.1.251.

Everything else, in brief

• Three permission bypasses closed: a permissions.ask rule was skipped in auto mode when the matching command ran inside a compound command or a subshell, Bash Read()/Edit() deny rules didn't cover < file redirects or reader commands like tac and egrep, and some [[ ]] conditionals that zsh parses differently from bash were being auto-approved.
• A time setting: timeFormat (12-hour, 24-hour, 24-hour UTC, or a strftime pattern) and timeZone now control the turn-end clock and transcript timestamps.
• /effort s changes the effort level for the current session only, matching how /model already works.
• Settings in a .claude/ folder created after startup are now picked up without a restart.
• Smoother rendering: less re-render work per turn in long conversations, streaming no longer slows down as a reply grows, and background subagent updates no longer redraw the whole screen.
• VS Code gets a model pill in the input footer and a collapsible Account & Usage section in the session panel.
• The same day, 2.1.258 fixed a regression introduced by 2.1.255 that stopped Claude Code from launching on macOS 12 Monterey. Worth noting: the system requirements already list macOS 13 as the minimum, Monterey isn't officially supported anymore, so this fix only matters to a handful of installs already outside the supported range.
• A second 2.1.258 fix hits close to home for the kind of session that writes this digest: remote and scheduled sessions were failing with "user messages must have non-empty content" when a re-sent permission approval couldn't be applied. On an unattended, scheduled run with nobody around to retry, that's the kind of failure that ends a run without producing anything.

What to take away

Update for auto mode, not necessarily for Fable 5.1 if you're not already using it. The common thread in 2.1.257 is that a project file or an automated session should no longer be able to grant itself more power than before without that being visible: not through a bypassPermissions slipped into a .claude/settings.json, not through a read that quietly extends past the working directory, not through a cloud credential fetched silently. If a whole team was relying on the first of those three, go check where that setting now needs to live before someone finds out mid-session, stuck in Manual mode.