Changelog — July 28, 2026

claude-opus-5 is here, and Anthropic calls it a step-change over Claude Opus 4.8. The headline specs:

• 1M token context window — and notably it's both the default and the maximum, so there's no beta header or opt-in to remember.
• 128k max output tokens.
• Thinking on by default.
• $5 / $25 per MTok — identical to Opus 4.8. A 1M context window at the same price as the model it replaces is the actual story here. Anthropic's consumer-side note puts it as coming close to Claude Fable 5's frontier intelligence at half the price.
• Available on the Claude API, Amazon Bedrock, Google Cloud (Vertex), and Microsoft Foundry on day one.

Effort is the primary control. Opus 5 supports the full ladder — low, medium, high, xhigh, max — with max reserved for capability-critical work. That matters more than it sounds, because effort is now coupled to whether you're allowed to turn thinking off at all (see the callout above).

Two other API changes landed the same day, both worth knowing if you build agents:

• Mid-conversation tool changes are in beta on Fable 5, Mythos 5, Opus 4.8, and Opus 5 — add or remove tools between turns while preserving the prompt cache, behind the mid-conversation-tool-changes-2026-07-01 beta header. For a long-running agent that swaps toolsets between phases, this removes a cache-invalidation penalty that previously made tool churn expensive.
• The fallbacks parameter gained a "default" mode, applying Anthropic's recommended fallback models by refusal category rather than making you hand-map them. Server-side fallback is still beta; the "default" mode needs the server-side-fallback-2026-07-01 header.

Who should care: anyone paying per token. If you were splitting work across models to stay under Opus 4.8's context ceiling, or paying Fable 5 rates for long-context runs, re-run your numbers — the price/context ratio moved. If you send explicit thinking blocks with high effort, read the breaking change first.

Claude API release notes → Affects: /claude-cowork/, /claude-cowork/pricing/, /claude-cowork/vs-api/, /tools/cost-calculator/

v2.1.219 is the Opus 5 release — it makes claude-opus-5 the default Opus model, with fast mode at $10 / $50 per MTok (the standard 2× on the API's $5/$25). v2.1.220, the next day, is bug fixes and reliability improvements only. The rest of v2.1.219 is a substantial feature batch:

• sandbox.network.strictAllowlist — a new setting that denies non-allowlisted hosts for sandboxed commands without prompting. Previously an unexpected host produced a prompt; strict mode fails closed instead. If you run Claude Code unattended, this is the setting that turns the network allowlist from advisory into a boundary.
• DirectoryAdded hook — fires after /add-dir or the SDK's register_repo_root control request registers a new working directory mid-session, so hooks can react to a workspace growing rather than only to session start.
• Nested subagents now go 3 deep by default (was 1). Subagents spawned at depth 2+ also now appear in stream-json when --forward-subagent-text is set, keyed by their spawning Agent tool_use id. Set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH=1 to restore the old behavior — worth knowing if you budget by agent count.
• Dynamic workflows now default to a medium size guideline (aim for fewer than 15 agents), settable from any settings file via the new workflowSizeGuideline key, with the current guideline shown in the running-workflow status line. When a settings file sets it, the /config row is hidden.
• mcp_server_errors in the headless stream-json init event, listing --mcp-config entries skipped by config validation; terminal runs print a startup warning. Silently-dropped MCP servers were a genuinely hard failure to diagnose.

The fix list is long and skews toward things that lost work or hid state:

• claude -p no longer drops an answer it had already produced when a turn dies on a mid-stream API error.
• A permission you approved while a self-hosted runner was restarting is no longer dropped on resume — the approved action now actually runs.
• On Windows, CLAUDE_CODE_GIT_BASH_PATH pointing at something that isn't a bash/sh binary no longer exits or gets used as bash; it's ignored with a warning.
• Copy-on-select inside GNU screen no longer prints base64 into the terminal instead of copying.
• Remote Control clients no longer keep a stale fast-mode status after a model switch, reconnect, or failed org check.
• Screen-reader mode stops rewriting the entire input line on every keystroke, and Vim mode's ← on an empty prompt returns to the agent view from NORMAL, not just INSERT.
• Self-hosted runner spawn and session failures now carry structured failure categories, so hook errors, runner crashes, and config errors can be told apart. A SIGTERM during runner startup now deregisters cleanly instead of leaving a stale active row until the lease expires.
• Managed MCP allowlist/denylist ${VAR} entries now resolve from the startup environment and managed-settings env instead of settings-file env.

Who should care: everyone — the default model changed under you. If you run sandboxed or unattended, look at sandbox.network.strictAllowlist. If you use workflows or subagents, both the depth default and the size guideline moved.

Claude Code v2.1.219 → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /openclaw/cost-optimisation/

The 1.0.0-rc.1 we covered a week ago is now stable. IronClaw 1.0.0 is not an increment on the 0.29.x line — it's a ground-up rebuild of the agent runtime, storage, extension host, and web UI. The ironclaw binary is the rearchitected CLI now; the v1 monolith builds as ironclaw-legacy and is not published at all.

Read this before you install: there is no migration for v1 config, databases, settings, or secrets, and installing 1.0.0 does not touch your existing v1 data. Point IRONCLAW_REBORN_HOME at a new directory, run ironclaw onboard, and reconnect your providers and channels. Do not aim it at a v1 data directory.

What ships:

• Seven platform targets — macOS (Apple Silicon, Intel), Linux (x86_64/aarch64, gnu and static musl), Windows (x86_64), with shell, PowerShell, and MSI installers.
• Guided setup. ironclaw onboard provisions config, the encrypted credential store, an LLM provider (interactive key entry with a live probe), a WebUI login token, and — on macOS and Linux — the background service. The credential store's master key goes into the OS keychain when one is available, falling back to a locally cached key file.
• 26 model providers in the built-in catalog, including NEAR AI, OpenAI, Anthropic, Gemini, Bedrock, Ollama, OpenRouter, Groq, and DeepSeek, plus any OpenAI-compatible endpoint. Managed with ironclaw models.
• Embedded web UI. ironclaw serve starts WebChat v2 with the frontend compiled into the binary — no separate asset deploy — serving chat, extensions, automations, settings, and admin from root-level routes.
• 12 first-party extensions embedded, installing with no network fetch: GitHub, Gmail, Google Calendar, Docs, Drive, Sheets, Slides, Notion, NEAR AI MCP, Slack, Telegram, and web access.
• Storage: file-backed libSQL by default, PostgreSQL available by config. Service management via install|start|stop|restart|status|uninstall as a launchd user agent (macOS) or systemd user unit (Linux).

What is still missing. A 1.0.0 label doesn't mean feature parity, and the release notes are candid about it: channels list, hooks list, logs, mcp, memory, pairing, import, and login either return "not implemented yet" or have no equivalent; onboard --import-history parses its flag but does nothing; skills is list-only from the CLI; and production/migration deployment modes return errors for extensions and skills. If your 0.29.x setup leans on MCP or memory from the CLI, 1.0.0 is not yet where you land.

Who should care: new IronClaw users should start here. Existing 0.29.x users should treat this as a parallel install to evaluate, not an upgrade — and should keep 0.29.1 running until the missing CLI surfaces fill in.

IronClaw 1.0.0 → Affects: /ironclaw/, /ironclaw/setup/, /ironclaw/configuration/, /ironclaw/security/, /ironclaw/skill-allowlisting/, /ironclaw/vs-openclaw/

Twenty commits on main since v0.0.94, with a security batch at the front:

• Five CVEs backported into the managed sandbox base images (#7679). libssh2 is rebuilt at 1.11.1 with reviewed upstream fixes for four memory-safety vulnerabilities — CVE-2026-66032, 66033, 66034, and 66035 — running the full upstream test suite, preserving the libssh2.so.1 soname, and rejecting any build that drops an exported Debian runtime symbol. Alongside it, the reviewed CPython 3.13 fix for CVE-2026-15308 (HTMLParser incremental-parsing complexity) is packaged as a narrow replacement for html/parser.py, bound to the exact Debian stdlib version and file hash. Both are installed and verified in the OpenClaw, Hermes, and Deep Agents Code base and completed images, with dpkg --audit checks repeated at both stages so a stale base can't reintroduce the vulnerable copy.
• The bundled claude-code policy preset blocked Claude Code's browser login (#7680). The preset never allowed platform.claude.com — the host Claude Code posts its browser OAuth authorization code to — so the login path the bundled skill documents first could not complete: the CLI reported Login failed: Socket is closed while the sandbox logged endpoint platform.claude.com:443 is not allowed by any policy. The preset now allows GET and POST on /v1/oauth/** for that host only; the rest of the host stays closed, and a contract test pins the exact two rules so the scope can't quietly widen to /**. Pro/Max subscribers can now finish the login with the preset as shipped.
• A non-interactive reasoning-effort input for compatible endpoints (#7711). NemoClaw exposed reasoning as a boolean only, so automation that needed an explicit effort value had to drop the setting or edit lower-level runtime config. A compatible OpenAI endpoint now takes NEMOCLAW_REASONING_EFFORT or --reasoning-effort (low, medium, high, or default for unset; the flag beats the variable), and the value survives resume, rebuild, and recreation the same way the reasoning flag does.
• nemoclaw host probe (#7443) — a new observation-only host readiness command with human-readable and --json output and deterministic exit codes (0, 2, 3). The public boundary rejects reports that claim mutation, redacts bounded evidence, and fails closed rather than emitting an unrepresentable finding. Paired with a platform qualification projection (#7445).
• config set accepts OpenShell host-bridge URLs again (#7681). An OpenClaw memorySearch embedding provider can now save a http://host.openshell.internal:<unprivileged-port> base URL. The exception is deliberately narrow — it applies only to models.providers.<provider>.baseUrl (OpenClaw) and model.base_url (Hermes), and rejects adjacent schemes, default or privileged ports, embedded credentials, queries, fragments, subdomains, and unrelated config paths, keeping the surrounding SSRF boundary intact. Ships with docs for host-side Ollama embeddings.
• Resumed sandbox recreation is journaled (#7690). A resumed same-name recreation now writes a secret-free lifecycle journal before deletion, and resume continues only when source identity, confirmed-missing source state, or matching generation plus journal/registry/live-ID fingerprints prove the next action. Ambiguous combinations now stop before another mutation instead of guessing — a direct registry delete could not recover across a process exit.
• Source-checkout installs preserve an absolute NEMOCLAW_OPENSHELL_BIN selection after refreshing user-local OpenShell discovery (#7710), which had been letting the Hermes GPU fallback test silently bypass its fault-injection wrapper. Relative selections are still rejected in favor of the discovered user-local binary.
• Internals and CI: registry seam ownership is isolated so persistence no longer imports upward, and owner-file write/rename failures propagate instead of being misclassified as lock contention (#7742); the E2E Dockerfile parser now handles backslash-continued and multi-source COPY instructions, which had been omitting four required files and producing a deterministic build-context failure (#7685); plus a trusted WSL CI helper, dependency ratchets, and onboarding FSM refactors.

Who should care: everyone running managed sandboxes should take the base-image rebuild for the libssh2 and CPython fixes. If you tried to log Claude Code into a NemoClaw sandbox with the bundled claude-code preset and hit Socket is closed, that was this bug — it's fixed.

NemoClaw commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/policy/, /nemoclaw/local-gpu/, /security/

A context-and-transparency release. The one people will notice:

• Reference past chats inline with @ (#12456). Typing @ in the prompt now surfaces a "Past chats" option that opens a searchable picker of previous sessions — scoped to the current workspace/worktree and searched like the Agent Manager session search. Selecting one attaches that session's transcript as context, so the model can build on a prior conversation; clicking the mention opens that session. Available in both the CLI TUI and the VS Code extension.
• Auto-approval explanations (#12494) — when a tool call is auto-approved, Kilo Code now tells you which rule permitted it. That's the difference between trusting an allowlist and auditing one.
• Queued chat messages can be deleted before they run from the VS Code chat (#12370), and session queue state is now emitted so remote clients can display the queue too (#12297).
• A searchable open-tabs switcher in the sidebar tab bar (#12462), and /sessions history is filtered to the current Agent Manager worktree (#12509).

Fixes: Enter no longer activates the first result in searchable lists when no row is highlighted (#12486); plan implementation sessions open immediately and submit recovered choices without extra clicks (#12511); and two diagnostics improvements surface the request and Gateway generation IDs when a provider returns an unexpected finish reason (#12496) or none at all (#12488) — the IDs you need to actually file a useful provider bug report.

Kilo Code v7.4.16 → Affects: /kilocode/, /kilocode/orchestrator/, /kilocode/security/

Two new transcription models. gpt-transcribe handles accurate file transcription and produces the final transcripts of committed Realtime turns; gpt-live-transcribe does low-latency streaming transcription. They land on v1/audio/transcriptions and v1/realtime respectively, and both support free-form transcription context, keyword hints, and multiple input languages.

The pairing is the point: use the live model for the interactive stream and the file model for the durable record of the same turn, rather than picking one and accepting either latency or accuracy loss. For agent builders, the keyword-hint support matters most — domain jargon and product names are where general transcription usually fails.

OpenAI changelog → Affects: /chatgpt/, /chatgpt/api-vs-chat/, /chatgpt/pricing/