Claude Code v2.1.224

Memory goes from read-only to read-write. Alongside memory_list and memory_read, Claude can now create or overwrite a whole document in a connected, writable memory store, and is prompted to check each of your replies for corrections and preferences worth keeping. Writes are refused for read-only stores, empty content, content over the byte cap, or anything a secret scan flags. Requires memory stores to be connected via CLAUDE_MEMORY_STORES, the allow_memory_sync permission, and CLAUDE_CODE_DISABLE_ORG_MEMORY unset.

The CLI now ships and dispatches a whole self-hosted-runner subcommand tree: orchestrator, setup, doctor, code-sign, decode-token, plus a bare runner mode. None of this code was in 2.1.223. No flag or remote gate sits in front of the dispatch, so anyone who types the command reaches it.

A new slash command, aliased /peers, lists your subagents alongside other reachable Claude sessions: local ones on the same machine, cloud sessions, and Remote Control bridge sessions. Each row shows status, working directory and age. It appears only when peer messaging itself is available.

A new subcommand for people running their own Claude Code runner fleet. It polls the server for hints that more runner capacity is needed and runs ${hooks-dir}/spawn-runner once per hint, so autoscaling is handled by a script you write. --hook-concurrency defaults to 4, --hook-timeout to 60s, and --expected-spawn-seconds to 120 (sent to the server as the lease time). --min-idle requests standby capacity, --debug-dir keeps diagnostics.

Nine new tools let an operator inspect and drive a self-hosted runner fleet: self_hosted_runner_get_pool, _list_runners, _list_sessions, _list_secrets, _spawn_local, _read_health, _read_metrics, _tail_log and _requeue_session. They load only when the CLI's --base-tools names one of them, and never when CLAUDE_CODE_REMOTE is set or the session kind is "bg". Auth reuses the operator's existing OAuth session, and tailed logs are redacted for secrets before reaching model context.

Passing --scm-connector-host opens a persistent WebSocket to Anthropic and proxies inbound HTTP requests to a GitHub Enterprise server that is only reachable from inside your network. --scm-connector-id is required alongside it, --scm-connector-provider defaults to ghe, and --scm-connector-ca-file supplies a custom CA. The connector is entirely off unless you pass the host flag.

The tool that publishes artifacts can now read and write a published artifact's document database, through two new actions read_db and write_db. Reads take a db_op of get, list or query; writes take set, update or delete, addressed by collection and doc_id. The actions only appear in the tool's schema when the tengu_umber_lattice gate is on (source fallback is false, real value from remote config) or the CLAUDE_CODE_ARTIFACT_DB environment variable is set.

Startup opens a local socket so other Claude Code sessions on the same machine can send this one messages. In the previous build the call site was empty. It is off unless the tengu_harbor_kite gate is on (in-source fallback false) or CLAUDE_CODE_HARBOR_KITE is set, and it never runs on Windows.

A tool that lists the other Claude Code sessions you can send a message to now exists and is registered, under the name ListAgents with the alias ListPeers. It is off unless the tengu_harbor_kite gate is on (source fallback false, real value from remote config) or the CLAUDE_CODE_HARBOR_KITE environment variable is set, and it never runs on Windows.

Cloud sessions can now start from more than the git bundle. A new seeding step finds files that are untracked but not gitignored, hashes them and uploads them to the session, with hard ceilings of 192 files, 104857600 bytes (100 MB) and a 60 second deadline. It is off unless the tengu_violin_wood gate is on (it falls back to off, including on any error) and the project setting remoteFileMode is container_sync. Otherwise the session starts from the git bundle alone.

In auto mode, deciding to ask on the AskUserQuestion tool no longer automatically counts as needing a human and halting the run; it can be classified and handled instead. CLAUDE_CODE_AUTO_MODE_CLASSIFY_ASK_USER_QUESTION decides this if set; otherwise the server-side auto mode config's classifyAskUserQuestion value applies and is treated as on unless it is explicitly false, so with no server value the new behaviour is active.

Running Claude Code non-interactively with --environment now creates a cloud session straight from the command line. It prints the title, session id, view URL and a resume hint, or with --output-format json emits an object with ok, session_id, url and pool_id. A prompt is required, as a positional argument or on stdin, and its absence is a hard error.

With the isolatePeerMachines protection enabled, sending a message to a Remote Control session, to a cloud session, or to a name that could not be resolved because the cloud session list was unavailable, now stops and asks for your explicit approval instead of going ahead.

Messages arriving from another session are now sorted into three classes, and a new "coordinator" class (a task notification that carries a peer send-message) is delivered unless you explicitly set crossSessionInbound. Set it to refuse to reject them or hold to buffer them; with no setting at all, coordinator messages are accepted outright.

Set CLAUDE_CODE_MESSAGING_SOCKET to a socket path and Claude Code records it with the session and, when the output format is stream-json, turns on replay of user messages without you asking for it. The variable is also carried through the set of CLAUDE_CODE_* variables Claude Code forwards to what it launches.

A settings key controlling what happens when another of your Claude Code sessions sends this one a message. Values are accept, hold and refuse. Left unset, a message is delivered automatically only when the sending session's permission mode is in the same class as yours, and is otherwise held for you to approve.

claude --environment <environment_id> starts a cloud session on one of your own self-hosted environments (ids look like ccpool_...). An id that does not parse is rejected with an explicit error. Hidden companions --pool (a deprecated alias), --correlation-id, --ref and --on-branch also exist.

Incoming messages on the repl bridge were always classified as ungated because the classification was hardcoded, so any text arriving could be run immediately as a command. Messages are now classified from their content, platform, origin and receiver grouping, and the run-immediately shortcut is taken only when that classification really is ungated. Peer and coordinator messages go through the normal accept-or-hold policy.

When another Claude Code session sends this one a message, it can now be held instead of delivered. Two new reasons for holding: the sender's permission mode does not match yours, and a sender that never stated its mode into a session that bypasses prompts. Held messages appear with an explanation and, where a permission handler is wired up, an approve/deny dialog with a preview. Approving, denying or letting it expire sends a status message back to the sender.

Startup registers an internal hook that watches Bash tool output and injects a system message when it sees a completed git commit, so the model is prompted to review what was just committed.

Memory document content is scanned before it is written, and a match refuses the write with a message naming what matched and noting that the store is shared with everyone on the project. The tool's own instructions carry the same rule. Behind tengu_haze_glass, which is false in this build.

An MCP tool that declares it requires user interaction no longer has its permission re-checked in the background and auto-proceeded when the check returns "allow". Those tools always reach you.

Groundwork for a per-session attention budget, one of "w25", "w50", "w100", "w200" or "unlimited" and defaulting to "unlimited". A cycle handler emits tengu_attention_budget_cycle, a new attachment type carries the budget into and out of the transcript, and two new key actions "chat:attentionUp" and "chat:attentionDown" exist. None of it is reachable: the chat key bindings and handler map both splice in an empty object where those entries would go.

The code that prepares a git working copy for runner and bring-your-own-compute sessions is now in the bundle; the previous release only declared its environment variable. It is not reachable from an interactive session. CLAUDE_RUNNER_FETCH_DEPTH tunes clone depth and accepts full, 0, or a positive integer, with an unparseable value logged and ignored in favour of the default.

The Artifact tool can expose a pr_review option that publishes a composed pull request review page from a JSON payload you author, rendered through a bundled template. It is backed by a large new review format covering diagrams, flows, before-and-after comparisons, concerns with visuals, and followups. The helper that decides whether the option is offered returns false unconditionally in this build, so the option never appears.

Set CCR_SHR_SSE_HINTS and the runner holds an event-stream connection to the server and wakes its poll loop as soon as a work_available event arrives, instead of waiting out the full poll interval. It defaults to off, and nothing else in the build turns it on.

Two new subcommands re-launch Claude with a fixed system prompt and a restricted tool allowlist to guide an operator interactively. setup goes from creating an environment in the Admin UI to a live runner and writes ./runner-setup/CHEAT-SHEET.md. doctor works through nine diagnostic categories one step at a time and produces a redacted tarball you can attach to a support escalation.

The bundled tool-use reference now documents max_uses, max_tokens and caching on the advisor tool definition, along with the advisor_tool_result_error content variant and its error codes. The cURL guide gains session budget examples: creating one with max_list_cost in minor currency units, raising or lowering it, or removing it, which is one-way. Agent version is now an integer rather than a string.

Claude can now prepare a draft feedback report about Claude Code locally. Nothing is sent automatically: the draft waits for you to review and submit it via /feedback, and the model is instructed not to announce it in the middle of a task. Scope covers both product bugs and the model's own behaviour, such as retracting a correct answer, stopping short of finishing, or spawning too many subagents.

--configure-git sets a git identity of Claude <[email protected]>, installs an SSH commit signing program and Co-authored-by hook stubs under <base-dir>/.runner, and requires git 2.34 or newer. The signing itself is done by a new self-hosted-runner code-sign subcommand, which sends the commit to the session's signing endpoint using the session access token.

The local socket used for session-to-session messaging binds under $XDG_RUNTIME_DIR/cc-socks/<pid>.sock, with the directory created 0700 and the socket 0600, and its path exported as CLAUDE_CODE_MESSAGING_SOCKET. If you pass --messaging-socket-path pointing at a socket something is already listening on, startup refuses rather than hijacking it.

Claude Code can now list your organization's self-hosted runner pools (machines your org runs itself rather than Anthropic-hosted ones) and target one for a remote session. Availability is decided by your organization's server-side configuration and first-party login; other auth returns an empty list.

Before starting a session, the runner inspects the checked-out repo's .claude/settings.json and settings.local.json for grants that would escape the session workspace and reports or blocks them. --confine-repo-settings (or SELF_HOSTED_RUNNER_CONFINE_REPO_SETTINGS) picks enforce, warn or off; the CLI defaults to warn, which logs what it would have refused and starts the session anyway.

The runner's health server accepts OTLP/JSON metrics on POST /v1/metrics and merges them into its own /metrics output, labelled with session_id and client_platform. When capacity is above 1 and you have set OTEL_METRICS_EXPORTER=prometheus, child sessions are automatically pointed at http://127.0.0.1:<health-port>/v1/metrics instead, so one scrape target covers the whole machine.

Credential entries under sandbox.credentials can now use decode: "jwt" to swap a real token for a structurally valid fake so client-side parsing still works, and maskClaims to mask only named claims and rebuild the token. A new awsPairs setting groups masked environment variables into access-key, secret and session-token trios so the proxy can re-sign AWS SigV4 requests, and a new sigv4 block sets deny or passthrough policy for streaming uploads, presigned URLs and SigV4A.

Rosters accept a new {"type": "advisor", "model": ...} entry, at most one per roster, letting the main thread consult a more capable model partway through a turn.

The bundled claude-api skill, the documentation Claude Code consults when you ask it to write code against the Claude API, now documents a session budget. It is set at create time only, in minor units and USD only, for example {"type": "limit", "max_list_cost": {"amount": "2500", "currency": "USD"}}. A session that reaches the cap pauses idle instead of terminating, and only resumes if the budget is raised or removed.

Reading an org memory document now shows a version token next to the updated date, writes report the version they produced, and a concurrent edit produces a distinct conflict result telling the model to re-read the document and retry with the fresh token. Requires org memory to be enabled for the session.

The activity summary after a turn reports workshop writes as their own line, "workshop making/made N page edit(s)" with a diff stat of lines added and removed. If nothing else happened but hooks ran, it adds a line counting how many PreToolUse hooks fired and how long they took in total.

New code fetches your remaining free cloud reviews from /v1/ultrareview/quota (3 second timeout) and can show that count in the slash-command menu, plus two one-off tips: a prose pointer, and a hook that fires after a git commit suggesting /ultrareview before you push. Each of the three surfaces, slash_menu, prose_pointer and post_commit, is keyed separately in the tengu_ultrareview_awareness remote config, so with no server value nothing appears.

Claude Code can build a listing of the memory files under a directory and feed it in as an extra memory source, under a virtual path named <auto-memory-index> rather than a real file. The content begins with a generated line naming the directory and noting that the paths below it are relative. It is off unless a server value enables tengu_stone_shell, whose built-in fallback is false, and it is skipped entirely when CLAUDE_CODE_REMOTE is set.

New read and write operations address documents by page address, collection path and document id, with errors for a bad address, an over-long composed path and a missing document id. Consent is remembered separately for reads and writes, and again separately for approvals given by a person in plan mode.

The effort level slider can label each level with an estimated cost multiplier against the model's default effort, shown as ~2x or ~0.25x, with a distinct note on the default level. It is behind the tengu_marbled_teal gate, which falls back to off, and it also needs per-model cost index data to be present.

The thinking-effort picker gains a description line under each level: the default level is labelled as the default, and the others show an estimated multiple of the default's cost taken from the model's cost index. When shown it replaces the warning about overthinking at the top level. It is behind the remote flag tengu_marbled_teal, which falls back to off in this build, so whether you see it is decided by server config.

When another session sends file attachments, they are now checked before Claude sees them: the attachment list is schema-parsed and capped in count, each path must sit inside the transfer staging directory, must be a regular file, and must match the declared size and hash. Verified files are copied into an uploads directory with owner-only permissions. This runs only with peer messaging enabled.

The fleet view refresh folds in other concurrent interactive sessions found in the local process registry, so sessions started outside its own bookkeeping appear. Needs both the tengu_fleetview_peers gate (in-source fallback false) and the cross-session messaging gate.

A build-gated change to the memory tools makes every write carry if_version: either the 12-character version token returned by the most recent read or write of that path, or the literal word new for a document that does not exist yet. The model therefore has to read a document before overwriting it. Reads now return the token; listing does not. Off in this build unless the tengu_haze_glass gate is on, which defaults to false.

The new artifact database actions ask before first use, and the prompt spells out how far approval reaches: approving a write covers database writes to any artifact for the rest of the session, approving a read covers that one artifact for the rest of the conversation. Writes persist and are visible to everyone who can open the artifact. The actions are gated behind CLAUDE_CODE_ARTIFACT_DB and the tengu_umber_lattice gate.

SendMessage can now target a peer by local socket (uds:) or by session id (bridge:), with failure advice that distinguishes a stale socket from a busy pipe, and it records a send_message_delivery event with the route taken and the time it took. Both address schemes are refused at validation time unless the peer feature is on, which needs tengu_harbor_kite or CLAUDE_CODE_HARBOR_KITE and a non-Windows machine.

Teleporting to a cloud session can now inventory your git root and upload untracked working-tree files so the remote session starts with them, reporting progress as it goes. It needs both the tengu_violin_wood gate, whose fallback is off, and the per-project setting remoteFileMode set to container_sync. If the upload times out or is unavailable, teleport falls back to sending the git bundle alone.

Messages passed between agents now include the sender's permission mode in the message header, drawn from a fixed two-value list, and the parser preserves it when a message is relayed through further hops.

--pool-secret-file and SELF_HOSTED_RUNNER_POOL_SECRET still work on both the runner and the orchestrator but now print a deprecation warning to stderr. Use --environment-secret-file or SELF_HOSTED_RUNNER_ENVIRONMENT_SECRET instead; the error shown when no secret is supplied at all names only the new spellings.

Both options are no longer hidden and now appear in help output. --remote stays hidden as a deprecated alias.

A new environment variable lets Bedrock users choose which regional inference-profile prefix models resolve to. Accepted values are us, eu, apac, jp, au and global. It is added to the environment passthrough sets used for sandboxed and spawned processes, so child processes inherit it.

After cases run, report.html is written into the results directory even without --report, and the report is published to claude.ai by default rather than only with --publish-report. Pass --no-publish to keep it local. --no-publish and --publish-report together are an error. Publish-by-default is controlled by a server flag whose built-in fallback is on, so with no server value it publishes; an explicit --publish-report ignores the flag entirely.

A settings key accepting 60s, 5m, 10m or never sets how long a permission or user dialog forwarded to a remote client stays parked awaiting an answer, and how long a held cross-session message waits for approval, before it resolves to its safe default. Without the setting the timeout is 300000 ms (5 minutes). CLAUDE_CODE_USER_DIALOG_TIMEOUT_MS overrides both.

A new settings key controls how long a permission or question dialog forwarded to a remote client stays parked, and how long a held cross-session message waits for approval, before resolving to its safe no-action default. Accepts "60s", "5m", "10m" or "never", defaults to 5 minutes, and falls back to the default on an invalid value. Purely local prompts are unaffected.

A message arriving from another Claude Code session used to show as raw XML. It now renders with an "@ name" header and the body indented, with the wrapper tags stripped. Outside verbose and transcript mode, and when not queued, it collapses to a compact peer marker.

The built-in feedback drafting tool used to be scoped to Claude Code the product. It now explicitly handles model-behaviour reports too, and will offer to draft one when Claude itself goes wrong in the session: retracting a confident answer, stopping short of the task, declining something reasonable, spawning too many subagents, tone problems, over-questioning, or scope creep.

The per-session cap on how many forked-skill subagents you can spawn is gone from this build entirely. The rule that only one agent per forked skill runs at a time is now checked both before and after the async write that reserves it, closing a window where two launches could both get through.

A malformed sandbox.credentials block used to be dropped entirely, leaving no credential protection in place. It now degrades to a deny-everything skeleton: all sigv4 signing modes deny, and implicit AWS credential pairing is suppressed rather than left open.

A plugin turned on solely by settings committed in the repository you opened is no longer written into your own plugin installation records. Previously a project or local settings file could get a plugin auto-installed on your behalf. Plugins backed by your own config are unaffected.

Losing the Remote Control connection now adds a warning message to the conversation instead of failing silently, with a hint to run /remote-control to reconnect. The hint is omitted when the reason already mentions logging in, remote control, a restart, policy or an update, and an identical message is not repeated twice in a row.

The self-hosted runner tools now check up front that you are on Anthropic's own API and signed in with claude login. An API key is not accepted. Failures carry the HTTP status, and 401 or 403 responses append a hint pointing at claude login and ANTHROPIC_BASE_URL.

When you send a message to another Claude session and the recipient holds, denies, or lets it expire, your session now prints a warning line and quietly tells the model not to sit waiting for a reply. Receipts arrive in batches of up to 200 per status and are de-duplicated per recipient address.

There is no longer any cap on how many subagents one session can spawn. The limit, its error message and the counter that tracked spawns have all been removed. Subagents launched from a forked skill still stop at the nesting depth limit and still refuse to start a duplicate of one that is already running.

A session flag for "wizard operator tools" ships defaulting to off, and its setter refuses to be passed false outside tests. Once something enables it during a session, nothing in normal operation turns it back off. No code in this build turns it on.

The skill docs add inference_geo, either "us" or "global", set inside an agent's model object rather than at the top level as on the Messages API. It is checked when the agent is saved, when a session is created, and on every turn, and it cannot change for the life of a session.

Publishing a review page for the first time now rejects more than 3 unchanged-item entries, more than 3 followups, a bottom line longer than 600 characters, or any concern body longer than 300 characters. Pages already published under the older, looser limits can still be republished as they are.

The collapsed activity summary now counts writes to workshop documents (files like .workshop.md or .workshop.html outside your working directory) on their own, with lines added and removed, rather than lumping them in with scratchpad writes.

Among the new database errors for artifacts is one for publishing: if the artifact's currently published version does not declare the db capability, the call fails and tells you to republish with it declared. Database access is opt-in per artifact rather than automatically available. Gated by CLAUDE_CODE_ARTIFACT_DB and the tengu_umber_lattice flag.

Creating a cloud session can now build a different request body for the newer session-create endpoint, carrying worker, source, outcome, seed bundle and branch-reuse fields in place of the older single session-context blob. It applies only when an account-level check passes and the session comes from ultrareview or ultraplan; nothing in this build sets that check, so what accounts get is decided elsewhere. --project and agent dispatch still refuse outright on accounts still using the old endpoint.

When a session is detected as a copy of another that is still live, a one-time note is queued for the model explaining that history up to the fork point is shared, that the two have since diverged, and how to find and message the sibling. Requires the tengu_harbor_kite gate (fallback false) or CLAUDE_CODE_HARBOR_KITE, and is skipped on Windows.

A new note injected into the conversation tells the model that this session is a copy of another session that is still running, when the copy was made, and how to find and message the original. It is off by default: the path is disabled on Windows and otherwise falls back to tengu_harbor_kite being false, so it only runs if remote config or CLAUDE_CODE_HARBOR_KITE turns it on.

New code builds a memory index at load time by walking the memory directory, taking the most recently modified files and reading each one's name and description header fields, falling back to the filename and first heading. The result is rendered as markdown and truncated at a byte budget. It runs only for stores that ask for a generated index; stores without that keep using an index file on disk.

When a cloud session comes from an ultrareview or ultraplan source and the tengu_woven_harbor server flag is on, creation uses a newer endpoint, and only then are grouping sessions under a --project and dispatching to a Kindling agent accepted instead of refused. The flag falls back to off when the server sends no value, so by default the existing refusals still apply.

Main-session assistant messages are now checked for text that looks like Claude Code's own internal control markup, including system reminders, harness envelopes and token-count, session-context, wake and role-turn shaped lines. Nothing is rewritten; the matches are only counted and reported.

Startup now also loads and starts directory sync apply for the current directory, in the same branch that starts the working-file syncer, and logs dir_sync_apply_import_failed if that load fails. The branch runs only when both CLAUDE_CODE_ENVIRONMENT_KIND and CLAUDE_CODE_DISABLE_WORKING_SYNC are unset, which is the normal local case.

Four entries in the bundled model list now carry a cost multiplier per effort level, for example low: 0.47, medium: 0.74, high: 1, xhigh: 2.41, max: 5.59 on one and a gentler xhigh: 1.6, max: 1.7 on others, alongside the existing default effort of high. The remote config schema was extended to match, each level an optional positive number, so a server can override them. No code in this build reads the values back.

The record written when re-entering plan mode now notes when the configuration calls for artifacts first, alongside the plan file and doc paths it already stored.

Resolving whether remote control is on at startup now returns the origin of the value as well: managed policy, a command-line flag, user settings, an older global config value, a project or local setting turning it off, or nothing set. The warning that repo-scoped settings are ignored is unchanged. Nothing in the build was found reading the origin.

CLAUDE_CODE_DISABLE_ARTIFACT, and the managed disableArtifact setting, are now checked first in two more artifact enablement paths. Previously those paths could still report artifacts as enabled with the kill switch set.

The health listener (--health-port, default 8080, 0 disables) now serves Prometheus metrics at /metrics alongside /healthz. The runner exports claude_code_self_hosted_runner_: capacity, active and initializing sessions, per-platform session counts, init duration, poll errors and per-session idle time. The orchestrator exports claude_code_self_hosted_orchestrator_: queue depth, spawn-hook outcomes, spawn-hook and queue-wait histograms, clock skew and connector state.

The runner gains a set of flags for managing how long it lives. --retire-at (or SELF_HOSTED_RUNNER_RETIRE_AT, an absolute Unix timestamp in seconds) releases active sessions, stops accepting new work and exits 0. --release-idle-session-min and --startup-timeout-min (default 15) are watchdogs, --kill-session-after-min waits for the current turn to finish first, and --drain-wait-sec sets drain time.

Checkout hooks, post-session hooks and the remote runner environment now export CLAUDE_RUNNER_SESSION_UUID and CLAUDE_CODE_REMOTE_SESSION_UUID, so your scripts can key on the session. Neither existed in 2.1.223.

Domain allow and deny rules in the sandbox now parse a host pattern plus an optional port, so a rule can target a single port rather than the whole host.

claude plugin eval now publishes the HTML report by default when your account supports it. --publish-report changed meaning to "require publishing", and explains why if it is unavailable; --no-publish keeps the report local. Passing both is now an error. --report now means the report replaces the results directory, implying a default location.

Violation suppression is no longer all-or-nothing. A "*" key still applies to every command, and other keys are matched against the command text so you can silence violations for one command only.

When you are not logged in, both the input check and the tool call stop immediately and name the credential source that is standing in the way: the ANTHROPIC_API_KEY environment variable, the apiKeyHelper setting, a token file descriptor, or a Unix socket, each with its own fix.

In background and async contexts where a permission prompt cannot be displayed, tools requiring approval are now denied with an explicit instruction not to claim success or retry, replacing the generic "Permission to use X has been denied" wording. A structured decision reason is recorded alongside it.

In headless runs and async agents, a denial no longer just echoes the request back. The model is now told the action requires interactive approval, that permission prompts are not available in this session, and explicitly not to claim success or retry, with the original request appended.

Records of blocked syscalls in the Linux sandbox now carry the actual command text rather than an opaque internal id, using the same lookup macOS already used. This also means ignoreViolations patterns match against the command you wrote.

The single "needs claude.ai login" message split into three: sign in to a console account, a remote session whose launching machine is not signed in, and a session running on a credential injected by its host environment that takes precedence and cannot be changed from inside the session.