Comment reply permission prompts sit behind CLAUDE_CODE_ARTIFACT_COMMENTS, off by default.
Replying to an artifact comment can never be auto-allowed, and the confirmation states the artifact's sharing state so the audience is clear before posting.
- Permission for
replyreturns behavior "ask" withsuppressAlwaysAllowRule, so no always-allow rule can be created. - Before prompting, the artifact's share mode is probed; the message says whether the artifact is shared, falling back to share-status-unconfirmed wording when the probe fails.
- Reading comments is allowed without a prompt, except when the read was triggered by a new-comments notification, which forces a prompt.
- Behind the artifact-comments gate (
CLAUDE_CODE_ARTIFACT_COMMENTS/tengu_teal_corbel).
Posting a comment reply visible to other viewers requires confirmation
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
tengu_teal_corbel Off by default, switched on for this accountThe shipped code defaults this off, and the flag server returned on for the one account this site reads on this version. That is the reading that makes the entry above worth a second look, and it still says nothing about your account.
This account: on · anonymous baseline: on · compiled default in v2.1.221: off
These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.
Read once, for one account on one subscription tier, against v2.1.221. It isn't a statement about your account. What a flag value here can and cannot tell you
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
New in this build: CLAUDE_CODE_ARTIFACT_COMMENTS