Claude Code v2.1.199

• Operations include: list_projects, read_file, write_files, delete_files, finalize_plan, get_claude_design_prompt, render_preview, and more
• Write operations (write_files, delete_files) require a plan_token obtained from finalize_plan first
• Requires a claude.ai credential — not available via Bedrock, Vertex, or third-party providers
• First-party Design server has a consent gate: the user grants Claude agent access once per account; /design consent handles this
• Not available when nonessential network traffic is restricted

• SearchPlugins — search the org's plugin catalog by keyword; triggers SuggestPluginInstall to render an install card
• ListPlugins — list the user's currently enabled plugins; call after SuggestPluginInstall to confirm what was installed
• SuggestPluginInstall — render an inline plugin install card directly in the conversation
• SearchSkills — search the user's skills by keyword; triggers SuggestSkills
• ListSkills — list currently enabled skills
• SuggestSkills — render an add-skills card for org/shared/Anthropic skills not yet enabled
• SearchMcpRegistry — search the public MCP connector directory by keyword; returns directoryUuid values
• ListConnectors — list the org's installed MCP connectors, with enabledInChat status for this session
• SuggestConnectors — suggest connectors matching the user's intent

These tools are only available in Cowork remote sessions (CLAUDE_CODE_REMOTE is set).

• Group names are stored alongside the session metadata
• A new "group view" layout organizes the fleet by group tag
• Reserved group names (like "pinned", "ungrouped") cannot be used as custom labels
• Only local sessions can be grouped; remote sessions are excluded
• The group name is written to a group file in the session directory

• Guides users through role selection using an interactive role-picker chip row
• Supports roles including Engineering, Data science, Product management, Healthcare, Human resources, and others
• Includes plugin suggestions and connector setup steps
• Available only in remote Cowork entrypoint (CLAUDE_CODE_ENTRYPOINT=remote_cowork)

• PR walkthrough: triggers when Claude has reviewed, summarized, or explained a PR — suggests "publish an artifact walking through this PR"
• Code explanation: triggers when Claude has explained how code works — suggests "publish this explanation as an artifact"
• Analysis results: triggers when Claude has produced analysis or benchmark results — suggests "publish this as an artifact"
• Plan/design doc tip: surfaces after plan-mode work — "Working on a plan or design doc? Ask Claude to publish it as an artifact"

All tips only appear when the Artifact tool is available in the session.

• WFP (Windows Filtering Platform) egress filter now keys on the sandbox user's SID rather than a group membership token
• Installation still requires one UAC prompt (srt-win install or npx sandbox-runtime windows-install), but no logout is needed afterward
• New --sandbox-user-sid parameter replaces --group-sid in internal ACL commands
• Removed the "discriminator group" concept that caused token-refresh issues
• New WFP egress verification step (srt-win wfp verify) confirms the fence is active before use

• New extract field: a regex with a capture group 1 that identifies the credential value(s) within the file; the proxy substitutes only those captured values
• New onExtractNoMatch option controls what happens when the pattern matches nothing:
• "warn" (default) — logs a warning and leaves the file unprotected
• "deny" — degrades to full-file deny mode (file is blocked from sandbox)
• "error" — throws at initialization, preventing session start with a misconfigured entry
• New maskDuplicates option: also masks occurrences of extracted values found elsewhere in the file outside the capture groups

Example config:

{
  "credentials": {
    "files": [{
      "path": "~/.config/tool/credentials",
      "mode": "mask",
      "extract": "token=([A-Za-z0-9_-]+)",
      "onExtractNoMatch": "deny",
      "maskDuplicates": true
    }]
  }
}

• Added {{TAB_TITLE}} slot: controls the browser <title> element separately from the document heading {{TITLE}}. The .md publish path sets it to the filename while the visible <h1> shows the document heading
• Replaced hand-coded CSS color literals with vendored @ant/cds design tokens (the full token CSS is embedded verbatim and drift-tested in CI)
• Adds syntax highlighting for code blocks using highlight.js with language detection
• The plan-artifact skill instructions updated to reflect the new four-slot fill contract ({{TITLE}}, {{TAB_TITLE}}, {{EYEBROW}}, {{SUMMARY}})

• A new AgentApiErrorTerminationError class captures early terminations caused by rate_limit, overloaded, or server_error API error kinds
• The partial agent history is surfaced with a clear notice: "Everything below is PARTIAL output recovered from the agent before it was cut off. The agent did NOT finish its task — treat these results as incomplete."
• This prevents complete loss of context when long-running agents hit transient API errors

• Triggers on phrases like "I shouldn't have cleared", "before I cleared we had X", "I lost that when I cleared"
• Suggests: "Press Esc twice or type /rewind, then pick the previous-session entry at the top"
• Does not trigger for regret about file edits (that's undo-changes) or wanting context from an entirely different session

• Distinguishes transient pauses ("sync retries automatically and will push it once the server recovers") from permanent suppression ("NOT being synced to shared/server memory")
• suppressedUntilMs field allows sync to schedule automatic retry after transient failures
• New concurrent write conflict recovery: when another session updates a memory file while a write is in flight, the local write is reloaded from the server's version and the author is notified to re-apply their change
• mount_dir_foreign_partition error gives a specific message explaining split-store conflict

• max_output_tokens.default and max_output_tokens.upper are now populated for each model (e.g., Haiku 3.5: 8192/8192; Haiku 4.5: 32000/64000)
• advisor_rank field added to models eligible for the advisor tool; models without an advisor rank emit a clearer error message pointing to CLAUDE_CODE_ENABLE_EXPERIMENTAL_ADVISOR_TOOL=1

• Accepts a comma-separated list of plugin names or @owner/repo repository identifiers
• Exempted plugins are noted in loading messages: "despite CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS (exempted via CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS_EXCEPT)"

• Paths listed in extraCaCertPaths are read and validated (must contain at least one CERTIFICATE PEM block)
• Invalid or unreadable paths emit warnings and are skipped rather than failing hard
• Useful in environments that use internal certificate authorities for TLS inspection

• Controlled by yGd(): checks CLAUDE_CODE_GZIP_REQUEST_BODIES env var first; if unset, falls back to the tengu_gzip_request_bodies feature flag (default false)
• Only applies to requests whose target host is api.anthropic.com (verified by wce() URL host check); Bedrock, Vertex, custom ANTHROPIC_BASE_URL, and any non-Anthropic endpoints are unaffected
• When enabled, sets compress: "gzip" on the outgoing fetch options object, instructing the underlying HTTP layer to gzip-encode the request body before transmission
• When the request body is a string, a random whitespace suffix is appended before compression: a newline (\n) followed by 0–256 randomly chosen space or tab characters; this adds entropy to the payload to improve compression ratio consistency across requests
• No changes are made to response handling; response decompression was already in place