# Claude Code v2.1.199

> Claude Code v2.1.199, released 2 Jul 2026 (2026-07-02). 20 entries read out of the shipped bundle. Unofficial, and not affiliated with Anthropic.

Web version: https://changelogs.core-directive.com/v/2.1.199

Version 2.1.199 introduces a major integration with Claude Design (claude.ai/design) for collaborative design work, a full suite of plugin/skill/connector discovery tools for the Cowork environment, and session grouping in fleet view. Windows sandbox setup is significantly simplified by eliminating the logout requirement, and credential masking gains powerful regex extract support.

## New Features

### Claude Design Integration [Gradual Rollout]

**What**

A new `ClaudeDesign` tool that lets Claude work directly with claude.ai/design — a collaborative canvas for decks, prototypes, landing pages, and UI mockups backed by your team's design system.

**Usage**

`/design login # Authenticate with claude.ai for Design access /design consent # Grant Claude agent access to your Design projects /design <prompt> # Route to Design operations (import, export, status, etc.)` **Details** - Operations include: `list_projects`, `read_file`, `write_files`, `delete_files`, `finalize_plan`, `get_claude_design_prompt`, `render_preview`, and more - Write operations (`write_files`, `delete_files`) require a `plan_token` obtained from `finalize_plan` first - Requires a claude.ai credential — not available via Bedrock, Vertex, or third-party providers - First-party Design server has a consent gate: the user grants Claude agent access once per account; `/design consent` handles this - Not available when `nonessential network traffic` is restricted **Status** Feature-flagged (`tengu_omelette_fouet`) — rolling out gradually.

**Evidence**

ClaudeDesign tool (search for `"ClaudeDesign"`, `"/v1/design/mcp"`, `"claude.ai/design"`)

### Plugin, Skill, and Connector Discovery Tools

**What**

Six new tools that let Claude discover, list, and suggest claude.ai plugins, skills, and MCP connectors from within Cowork sessions.

**Details**

- `SearchPlugins` — search the org's plugin catalog by keyword; triggers `SuggestPluginInstall` to render an install card
- `ListPlugins` — list the user's currently enabled plugins; call after `SuggestPluginInstall` to confirm what was installed
- `SuggestPluginInstall` — render an inline plugin install card directly in the conversation
- `SearchSkills` — search the user's skills by keyword; triggers `SuggestSkills`
- `ListSkills` — list currently enabled skills
- `SuggestSkills` — render an add-skills card for org/shared/Anthropic skills not yet enabled
- `SearchMcpRegistry` — search the public MCP connector directory by keyword; returns `directoryUuid` values
- `ListConnectors` — list the org's installed MCP connectors, with `enabledInChat` status for this session
- `SuggestConnectors` — suggest connectors matching the user's intent

These tools are only available in Cowork remote sessions (`CLAUDE_CODE_REMOTE` is set).

**Evidence**

(search for `"SearchMcpRegistry"`, `"ListPlugins"`, `"SuggestPluginInstall"`, `"ListConnectors"`)

### Session Grouping in Fleet View

**What**

Sessions in fleet view can now be tagged with a group label, enabling a "group view" display mode alongside the existing "status view" and "folder view".

**Usage**

`ctrl+e # Set a group label on the highlighted session ctrl+x # Ungroup the session (press again to confirm)` **Details** - Group names are stored alongside the session metadata - A new "group view" layout organizes the fleet by group tag - Reserved group names (like "pinned", "ungrouped") cannot be used as custom labels - Only local sessions can be grouped; remote sessions are excluded - The group name is written to a `group` file in the session directory **Evidence** (search for `"ctrl+e to set group"`, `"ctrl+x again to ungroup"`, `"group view"`)

### Guided Cowork Setup (/setup-cowork)

**What**

A new `/setup-cowork` slash command that walks users through Cowork configuration in a structured onboarding flow: pick a role, install a matching plugin, try a skill, and connect tools.

**Details**

- Guides users through role selection using an interactive role-picker chip row
- Supports roles including Engineering, Data science, Product management, Healthcare, Human resources, and others
- Includes plugin suggestions and connector setup steps
- Available only in remote Cowork entrypoint (`CLAUDE_CODE_ENTRYPOINT=remote_cowork`)

**Evidence**

(search for `"setup-cowork"`, `"Guided Cowork setup"`)

### Artifact Publishing Tips

**What**

Three new contextual suggestions now appear during conversations, inviting users to publish their work as a shareable artifact.

**Details**

- PR walkthrough: triggers when Claude has reviewed, summarized, or explained a PR — suggests "publish an artifact walking through this PR"
- Code explanation: triggers when Claude has explained how code works — suggests "publish this explanation as an artifact"
- Analysis results: triggers when Claude has produced analysis or benchmark results — suggests "publish this as an artifact"
- Plan/design doc tip: surfaces after plan-mode work — "Working on a plan or design doc? Ask Claude to publish it as an artifact"

All tips only appear when the Artifact tool is available in the session.

**Evidence**

(search for `"artifact-publish-plan"`, `"publish an artifact walking through this PR"`, `"publish this explanation as an artifact"`)

## Improvements

### Windows Sandbox: No Logout Required

The Windows sandbox now uses a dedicated `srt-sandbox` user account instead of a Windows security group for network isolation. This eliminates the logout-and-back-in step that was previously required after installation.

**Details**

- WFP (Windows Filtering Platform) egress filter now keys on the sandbox user's SID rather than a group membership token
- Installation still requires one UAC prompt (`srt-win install` or `npx sandbox-runtime windows-install`), but no logout is needed afterward
- New `--sandbox-user-sid` parameter replaces `--group-sid` in internal ACL commands
- Removed the "discriminator group" concept that caused token-refresh issues
- New WFP egress verification step (`srt-win wfp verify`) confirms the fence is active before use

**Evidence**

(search for `"No logout is needed: the WFP filter keys on the dedicated \`srt-sandbox\` user"`, `"--sandbox-user-sid"`)

### Credential Masking: Regex Extract Patterns

The `credentials.files` sandbox setting now supports extracting and masking only specific values from a file rather than masking the entire file contents.

**Details**

- New `extract` field: a regex with a capture group 1 that identifies the credential value(s) within the file; the proxy substitutes only those captured values
- New `onExtractNoMatch` option controls what happens when the pattern matches nothing:
- `"warn"` (default) — logs a warning and leaves the file unprotected
- `"deny"` — degrades to full-file deny mode (file is blocked from sandbox)
- `"error"` — throws at initialization, preventing session start with a misconfigured entry
- New `maskDuplicates` option: also masks occurrences of extracted values found elsewhere in the file outside the capture groups

Example config:

`{ "credentials": { "files": [{ "path": "~/.config/tool/credentials", "mode": "mask", "extract": "token=([A-Za-z0-9_-]+)", "onExtractNoMatch": "deny", "maskDuplicates": true }] } }` **Evidence** (search for `"onExtractNoMatch"`, `"extract pattern"`, `"maskDuplicates"`)

### Plan Artifact Template: CDS Design Tokens and TAB_TITLE Slot

The plan artifact HTML template has been upgraded with the official Anthropic CDS (Component Design System) token set and a new title control slot.

**Details**

- Added `{{TAB_TITLE}}` slot: controls the browser `<title>` element separately from the document heading `{{TITLE}}`. The `.md` publish path sets it to the filename while the visible `<h1>` shows the document heading
- Replaced hand-coded CSS color literals with vendored `@ant/cds` design tokens (the full token CSS is embedded verbatim and drift-tested in CI)
- Adds syntax highlighting for code blocks using highlight.js with language detection
- The plan-artifact skill instructions updated to reflect the new four-slot fill contract (`{{TITLE}}`, `{{TAB_TITLE}}`, `{{EYEBROW}}`, `{{SUMMARY}}`)

**Evidence**

(search for `"TAB_TITLE"`, `"BEGIN vendored @ant/cds tokens"`, `"artifact-plan.html"`)

### Hook additionalContext: Structured JSON Output

Hooks that return exit code 0 now communicate with Claude through a structured `additionalContext` JSON field instead of plain stdout. This change applies to `SubagentStart`, `PreToolUse`, `PostToolUse`, and session-init hooks.

Before: Exit code 0 → stdout string shown to Claude/subagent directly.

After: Exit code 0 → stdout parsed as JSON; the `additionalContext` field from the parsed object is injected into Claude's context. Exit code 2 now routes stderr to the user only (previously stderr was ignored for blocking errors).

Hook descriptions updated:

`Exit code 0 - JSON additionalContext shown to subagent Exit code 2 - show stderr to user only Other exit codes - show stderr to user only` **Evidence** (search for `"Exit code 0 - JSON additionalContext shown to subagent"`)

### Agent API Error Recovery: Partial Output Surfaced

When an agent (Task tool) terminates early due to an API error such as rate limiting, server overload, or server errors, Claude now recovers and presents the partial output the agent produced rather than discarding it entirely.

**Details**

- A new `AgentApiErrorTerminationError` class captures early terminations caused by `rate_limit`, `overloaded`, or `server_error` API error kinds
- The partial agent history is surfaced with a clear notice: "Everything below is PARTIAL output recovered from the agent before it was cut off. The agent did NOT finish its task — treat these results as incomplete."
- This prevents complete loss of context when long-running agents hit transient API errors

**Evidence**

(search for `"AgentApiErrorTerminationError"`, `"PARTIAL output recovered from the agent"`)

### /rewind Tip After /clear

A new contextual suggestion now triggers when Claude detects the user regrets having used `/clear` and wants to access content from before the clear. Claude will suggest using `/rewind` and picking the previous-session entry to restore the conversation.

**Details**

- Triggers on phrases like "I shouldn't have cleared", "before I cleared we had X", "I lost that when I cleared"
- Suggests: "Press Esc twice or type /rewind, then pick the previous-session entry at the top"
- Does not trigger for regret about file edits (that's undo-changes) or wanting context from an entirely different session

**Evidence**

(search for `"rewind-past-clear"`, `"Press Esc twice or type /rewind"`)

### Memory Sync: Richer Status Messages and Auto-Retry

Memory sync status messages now communicate more precisely why a sync is paused and whether it will self-recover.

**Details**

- Distinguishes transient pauses ("sync retries automatically and will push it once the server recovers") from permanent suppression ("NOT being synced to shared/server memory")
- `suppressedUntilMs` field allows sync to schedule automatic retry after transient failures
- New concurrent write conflict recovery: when another session updates a memory file while a write is in flight, the local write is reloaded from the server's version and the author is notified to re-apply their change
- `mount_dir_foreign_partition` error gives a specific message explaining split-store conflict

**Evidence**

(search for `"Memory sync is currently paused"`, `"sync retries automatically"`, `"concurrent-write conflict"`)

### Model Catalog: max_output_tokens Limits and advisor_rank

Models in the internal catalog now carry explicit output token limits and an advisor ranking.

**Details**

- `max_output_tokens.default` and `max_output_tokens.upper` are now populated for each model (e.g., Haiku 3.5: 8192/8192; Haiku 4.5: 32000/64000)
- `advisor_rank` field added to models eligible for the advisor tool; models without an advisor rank emit a clearer error message pointing to `CLAUDE_CODE_ENABLE_EXPERIMENTAL_ADVISOR_TOOL=1`

**Evidence**

(search for `"max_output_tokens"`, `"advisor_rank"`, `"has no advisor rank in the model catalog"`)

### CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS_EXCEPT Exemption List

When `CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS` is set to skip plugin MCP servers, the new `CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS_EXCEPT` environment variable lets you exempt specific plugins from that skip.

**Usage**

`export CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS=1 export CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS_EXCEPT="my-plugin,@org/critical-plugin"` **Details** - Accepts a comma-separated list of plugin names or `@owner/repo` repository identifiers - Exempted plugins are noted in loading messages: "despite CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS (exempted via CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS_EXCEPT)" **Evidence** (search for `"CLAUDE_CODE_SKIP_PLUGIN_MCP_SERVERS_EXCEPT"`)

### Diff Panel File List Keyboard Navigation

New keyboard actions for navigating the file list in the diff panel:

- `app:diffFileListDown` — move down in the diff panel's file list; bound to `ctrl+down` and `meta+down`
- `app:diffFileListUp` — move up in the diff panel's file list; bound to `ctrl+up` and `meta+up`
- Both actions are registered in the `Global` keybinding context, meaning they are active in all UI states (chat, task running, diff dialog, etc.) and do not require the diff panel to have keyboard focus
- The actions appear in the global "always-available" action list (`fso`) alongside `app:toggleDiffNoiseFilter`, so they are shown in keybindings help when the diff panel is visible

**Evidence**

(search for `"app:diffFileListDown"`, `"app:diffFileListUp"`, `"ctrl+up": "app:diffFileListUp"`)

### extraCaCertPaths for TLS Certificate Trust

The sandbox TLS certificate bundle builder now accepts an `extraCaCertPaths` list to include additional PEM CA certificates in the trust bundle.

**Details**

- Paths listed in `extraCaCertPaths` are read and validated (must contain at least one `CERTIFICATE` PEM block)
- Invalid or unreadable paths emit warnings and are skipped rather than failing hard
- Useful in environments that use internal certificate authorities for TLS inspection

**Evidence**

(search for `"extraCaCertPaths"`, `"[mitm-ca] extraCaCertPaths:"`)

### Notification Tool: Clearer "Not Sent" Reason

The PushNotification/desktop notification tool now provides a specific reason when a notification is suppressed because the terminal is active:

"Not sent — this terminal is active, so your output here already reaches the user; a separate notification would be redundant."

Previously the tool returned a less specific "Not sent — terminal has focus" message.

**Evidence**

(search for `"Not sent — this terminal is active, so your output here already reaches the user"`)

## Bug Fixes

- Config write queue now correctly drains before process exit, relaunch, and `exitWithMessage` paths — previously a race could lose in-flight settings writes on shutdown. (search for `"write queue drain timeout"`)
- The settings write path now uses a proper async queue with in-order serialization (`_f`) for all config sections, preventing concurrent writes from clobbering each other. (search for `"saveConfigWithLock"`, `"mbn.set"`)
- `deleteCurrentProjectConfigFields` and `deleteProjectConfig` fallback paths now correctly re-base on the enqueue-time cache snapshot when a concurrent auth write is in flight, preventing auth loss. (search for `"enqueue-time cache snapshot. See GH #3117"`)
- Model alias picker no longer inserts duplicate entries when the current alias and its 1M variant are both in the list. (search for `"Failed to migrate"`, model alias migration error strings)

## In Development

Features with infrastructure added but not yet enabled.

### Request Body Gzip Compression [In Development]

**What**

Gzip compression of API request bodies, reducing bandwidth for large context uploads.

**Details**

- Controlled by `yGd()`: checks `CLAUDE_CODE_GZIP_REQUEST_BODIES` env var first; if unset, falls back to the `tengu_gzip_request_bodies` feature flag (default `false`)
- Only applies to requests whose target host is `api.anthropic.com` (verified by `wce()` URL host check); Bedrock, Vertex, custom `ANTHROPIC_BASE_URL`, and any non-Anthropic endpoints are unaffected
- When enabled, sets `compress: "gzip"` on the outgoing fetch options object, instructing the underlying HTTP layer to gzip-encode the request body before transmission
- When the request body is a string, a random whitespace suffix is appended before compression: a newline (`\n`) followed by 0–256 randomly chosen space or tab characters; this adds entropy to the payload to improve compression ratio consistency across requests
- No changes are made to response handling; response decompression was already in place

**Status**

Feature-flagged (`tengu_gzip_request_bodies`, defaulting false). Can be force-enabled with `CLAUDE_CODE_GZIP_REQUEST_BODIES=1`.

**Evidence**

(search for `"CLAUDE_CODE_GZIP_REQUEST_BODIES"`, `"tengu_gzip_request_bodies"`, `yGd()` call at the fetch wrapper, `wce(l)` host check at line ~161308)

- Flag `tengu_gzip_request_bodies`: Not enough to say (read for one account on one subscription tier against v2.1.199; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.