Claude Code adds hooks that can block a model switch

Version 2.1.251 adds PreModelSwitch and PostModelSwitch hook events, which can block, confirm, or annotate a model switch. SessionStart resume hooks now receive session staleness and the estimated re-cache cost. The same release closes several holes in the permission boundary itself. File tools were following a symlink swapped inside the working directory after the permission check had run, which could read or write outside the approved location. Grep and Glob were not applying Read(...) deny rules to files reached through a symlinked search path. The Workflow tool could read a scriptPath outside what the session may read before the permission check ran, and Bash permission checks were auto-approving commands that assign an arithmetic expression to an integer shell variable.

Why it matters: On August 26, Sebastien Guillemot, CTO of the Midnight Foundation, posted an account of a safety classifier downgrading his coding agent from Opus 5 to Opus 4.8 mid-run, after which the downgraded model wrote the delete script that removed his home directory. Guillemot reported that the switch happened without warning. Claude Code users can now block one. The symlink fixes also affect upgrade decisions: if you run agents unattended and treat file-tool deny rules as the containment boundary, this release is telling you that boundary was passable before it.