Claude Code v2.1.227

A new tool lets Claude propose a completion condition for the session that you approve with a single keypress, plus a matching notification, "Claude proposed a session goal". It takes an ask_user argument defaulting to true, and refuses in plan mode, inside agent contexts, and in non-interactive sessions. It is only available when the tengu_propose_goal gate is on, and that gate falls back to off.

A new dialog asks whether Claude Code may copy the current repository, including uncommitted and untracked files but never gitignored ones, into cloud sessions started from that directory. The options are "Yes, sync this repository", "No, don't sync" and "Not now", which is focused by default. The answer is saved per repository as remoteFileMode. The prompt is gated on the tengu_violin_wood flag, which is treated as off if it errors.

A new tool called device_bash lets a session running in the cloud execute a shell command on the machine where Claude Code is running, inside its OS sandbox, and return the output. It takes command plus an optional timeout_ms. It is off unless the remote-config flag tengu_violin_wood turns on the device bridge, and it still refuses without a server-asserted session and a bound device id.

A new tool lets Claude propose a completion condition for the session. Approving it sets a session goal, the same as running /goal, after which a separate check runs each turn and Claude keeps working until the condition is met. A new setting modelProposedGoals takes auto, alwaysAsk or disabled, shown as "Claude-proposed goals" in the config panel. Both the setting row and the tool are hidden unless the flag tengu_propose_goal is on, and it is off in this build.

A PermissionRequest hook can now stop the turn, not just the one tool call. The hook result carries an interrupt field alongside the decision; a hook that denies and sets interrupt true interrupts the turn. Denials without a message use "Permission denied by PermissionRequest hook". Allow decisions always carry interrupt false.

New machinery keeps watching a published artifact even when the session is not live, by minting a webhook through a dedicated wake service (watch_url and unwatch_url tools) and subscribing to the artifact's publish events. Unsubscribing releases both the subscription and the webhook. It requires a first-party client and the flag tengu_scalable_quiche, which is off in this build.

A remote worker session now pulls files changed on your laptop before each turn and pushes files it changed back after each turn, instead of the previous one-shot copy at startup. It runs only when the session has an SDK URL, CLAUDE_CODE_REMOTE_SESSION_ID is set, and both CLAUDE_CODE_ENVIRONMENT_KIND and CLAUDE_CODE_DISABLE_WORKING_SYNC are unset.

A new tool lets the model propose a goal for the session. The modelProposedGoals setting takes auto (the default when the key is absent), alwaysAsk to route every proposal through an approval dialog, and disabled to turn the tool off. Because the setting affects consent, it is only read from user, policy and command-line settings; project and local settings in the workspace are ignored.

When a subagent finishes, the final text it hands back to the parent agent is now itself reviewed by the auto-mode safeguard, treated as untrusted agent-authored output that could relay a prompt injection. Previously only the subagent's tool calls were reviewed.

Both the normal streaming reader and the thin-client stream path recognise an autocompact_state message and apply it, so auto-compaction state sent by the server is reflected in the client instead of being dropped.

New machinery ties a remote or cloud session to the device that started it, so local tools only run for that machine. Session creation registers the machine and signs a proof of the binding. It is gated on tengu_violin_wood, checked asynchronously, and any error means the session is simply not bound.

The status line can show a live one-line summary of what the current task is doing, replacing the thinking line, the elapsed-time indicator and the trailing ellipsis while it is present. It only appears when the app is holding a fresh summary and you are not viewing an agent task; nothing in this build was found to populate that summary, so it is not reachable through normal use here.

A "## Delegating to subagents" section tells Claude to handle small bounded sub-tasks inline, not to fan several subagents out on one small task, not to spawn one to double-check work it can verify itself, and to keep spawn counts low. It is only injected when the subagent steer resolves to "counter_steer". The steer is read from CLAUDE_CODE_THISTLE_GREBE, client data, the tengu_thistle_grebe flag, or a per-model floor, and defaults to "default", so the section is absent unless configured.

The scheduling tool gains two read-only actions, list_runs and get_run_log. get_run_log returns a condensed log of a single run covering provisioning, prompt, tool calls and errors, permission prompts and denials, API retries and the final result, with cursor paging. It requires a run session id starting cse_ or session_. Gated on the tengu_surreal_dali flag (off when the server sends nothing) plus the allow_remote_sessions and allow_routines policy settings.

The tool for sending files to another Claude Code session was previously disabled unconditionally. It is now behind the server flag tengu_send_file, which falls back to off when the server sends no value, so the tool can be switched on remotely without a new build.

Before running anything, the local-command tool checks the device's sandbox and refuses with a specific reason if sandboxing is off or unsupported on the platform, failed to start, is not in strict mode, allows all Unix sockets, or is set to inject real credentials into network requests. Each refusal returns an error saying what to change on that device.

A new storage backend, previously used at a handful of call sites, is now passed into hundreds of functions covering plugin install and update, marketplace refresh, settings writes, task and daemon state, transcript reads, MCP auth caching and worktree cleanup. A new React context supplies it via SessionServicesProvider and useSessionServices.

Notices that an artifact auto-reply subscription has stopped are now sent as task notifications carrying a type and a summary rather than plain strings. Supervisors watching a live artifact also refresh their last-activity timestamp on a new comment or publish, which delays idle teardown.

The command builder gained an option that skips injecting the usual credential exports and instead appends a scrubbing step before the command runs. At least one internal caller uses it alongside sandboxing and cwd-change prevention. There is no user-facing setting for it.

A new transcript entry marks a session whose earlier history was suppressed, most often because the signed-in account changed. Replay skips it, and remote sync refuses to backfill or upload the merged pair produced by compaction for any conversation carrying that mark.

The ultra review flow gained --post and --no-post flags and a third confirmation choice, "Run and post the findings to the PR as me", which runs the cloud review and posts the findings to the GitHub pull request as a comment from your own account. It is controlled by tengu_ultrareview_post_enabled, which falls back to on when remote config says nothing. If the target is not a GitHub pull request, or posting is turned off, the dialog says the posting request was dropped; a review that fails adds a note that nothing was posted.

/ultrareview and claude ultrareview now take --post and --no-post. With posting armed against a GitHub.com pull request, the finished review is posted as a single plain comment from your own GitHub account, not as a formal review. Posting is gated on tengu_ultrareview_post_enabled (falls back to on); when it resolves off the CLI replies that posting findings to the PR is currently turned off. Consent is session-scoped: end the session before the review finishes and nothing is posted.

Two new skills ship with this build. artifact-data-table builds sortable, filterable tables from strict JSON data, and a brand-neutral Data Visualization skill covers charts with a runnable palette validator plus components, palette and interaction reference files.

A new setting, modelProposedGoals, controls whether Claude can propose goals for your session. auto (the default when the key is absent) lets the model decide per proposal whether to ask you, alwaysAsk sends every proposed goal through the approval dialog, and disabled turns the feature off entirely. It appears in the config panel under "Input & controls" as "Claude-proposed goals".

After a review, Claude Code can now post the findings back to the pull request as a GitHub comment. It sets up an anthropic_cloud environment, registers a scheduled routine that is allowed only two GitHub tools (mcp__github__add_issue_comment and mcp__github__get_me), and runs it with the findings. Posting is controlled by tengu_ultrareview_post_enabled, which falls back to on; when it is off the reply is "Posting to the pull request is currently turned off".

Text produced by hooks is turned into visible assistant messages in the streamed output and counted as displayable by the output filter, so it reaches SDK consumers instead of being dropped.

Interactive sessions can now show a short headline saying what Claude is working on, in place of the generic activity text next to the spinner. It is produced by the existing post-turn classifier, which for this surface uses a cheap built-in heuristic instead of an extra model call. The remote setting tengu_classifier_disabled_surfaces (empty by default, so nothing is turned off) can list repl to disable it.

The connect timeout for an MCP server is now the larger of that server's own value and the global MCP timeout, so a small per-server value can no longer make connections fail early. Connection timeouts are tagged CONNECT_TIMEOUT and retried instead of failing outright, including timeouts raised by the MCP SDK itself. Controlled by the tengu_mcp_connect_timeout_retry flag, which is on unless the server turns it off.

When Claude reattaches to a session that was started earlier or handed over from another process, it now compares the account and organization recorded on that session against whoever is signed in now. On a mismatch it starts a fresh session instead and withholds the earlier history rather than replaying it under the new account.

Choosing a model now forces a server-side entitlement check instead of trusting cached access. If the check denies the model or cannot be completed, the switch is refused with the organization-restriction message rather than silently proceeding.

CLAUDE_CODE_MEMORY_API_BASE_URL and CLAUDE_CODE_MEMORY_API_TOKEN are now stripped from the environment given to every subprocess Claude Code spawns, the same way CLAUDE_CODE_OAUTH_TOKEN and CLAUDE_CODE_ARTIFACTS_API_TOKEN already were. A bash command or tool cannot read your memory API token.

Environment variables are now treated as sensitive when their name contains TOKEN, SECRET, PASSWORD, PASSPHRASE, KEY, AUTH, COOKIE, PAT, DSN or CREDENTIAL(S) as a whole word, plus CLOUDSDK_PROXY_PASSWORD and the numbered GIT_CONFIG_KEY_ variables specifically.

CLAUDE_CODE_ENTRYPOINT accepts a new value, remote_cowork_trigger, and sessions started with it count as trigger-launched and as remote, the same as the existing remote_trigger.

Skill discovery skips any skills directory named synced, which is reserved as the root that claude.ai syncs into. Importing from it reports the directory as skipped and explains that you should rename it and import manually.

A new built-in subagent reads a single comment thread on an artifact, optionally with the rendered page, and returns an analysis brief. It cannot call any other tool, is capped at 6 turns, and its brief is thrown away if it gets truncated. It is off unless you set CLAUDE_CODE_ARTIFACT_COMMENT_RESPONDER; failing that it checks tengu_bracken_sluice, which falls back to false.

The Artifact tool gains a resolve action alongside comments and reply, marking one comment thread on a published artifact as resolved. It is only offered when artifact comments are enabled, via CLAUDE_CODE_ARTIFACT_COMMENTS or the tengu_teal_corbel remote flag, which falls back to off, so nothing in this build turns it on by itself.

A watch can come back marked as a durable wake, meaning no live updates arrive and the session is instead woken by a new turn the next time the artifact is published, with instructions to re-read the artifact on wake. A separate message covers the case where that durable subscription could not be registered.

The list of artifact watches now distinguishes the live background connection from a durable subscription that wakes a remote session with a new turn when the artifact is published, with no live updates. The permission prompt shown for a first watch was rewritten to describe both, and the listing header no longer claims that no watch survives a restart when a durable one is present. This sits behind the same gating as the artifact comments and watch actions.

Watchers on published artifacts now send a periodic activity heartbeat with debounced start and stop edges, drop automatically-armed watches that have gone quiet past a time-to-live, and, when the session hits its watch limit, evict the least active one and say it "made room to watch a newer one". Watches you set explicitly and the most recently published artifact are never retired. Nothing in this build was found to switch the behaviour on or off.

The composer that drafts automatic replies to artifact comment threads can now carry a set of analysis notes from an earlier read of the same thread. The notes are injected into the prompt inside a fence and labelled as untrusted observations, never instructions. The whole path is opt-in via CLAUDE_CODE_ARTIFACT_COMMENTS_AUTOREACT or tengu_sorrel_trellis, which defaults to off.

The Claude Code for Desktop configuration schema accepts two more booleans, chatTabEnabled and chatAdvancedFileAnalysisEnabled, alongside the existing cowork and desktop-extension flags. Nothing in this build sets them; their values come from the desktop app.

Memory sync gained an alternative development backend that skips normal login and takes a bearer token from CLAUDE_CODE_MEMORY_API_TOKEN, with its address from CLAUDE_CODE_MEMORY_API_BASE_URL. The check that selects it calls a function whose body returns nothing, so the branch cannot be reached and normal memory sync is unaffected.

A new subsystem mints a P-256 keypair per account, stores it in secure storage, and registers it with your organization so a remote session can be tied to the specific machine that started it. It signs a binding payload when creating a session. Nothing in this build was found to switch the cowork remote-device flow on, so whether you ever reach it is decided elsewhere.

Two environment variable names for pointing memory at your own server, CLAUDE_CODE_MEMORY_API_BASE_URL and CLAUDE_CODE_MEMORY_API_TOKEN, are declared in this build and excluded from the environment restored from saved credentials. Setting them does nothing: the function that resolves the base URL has an empty body that returns nothing, so the override branch is never taken.

A completion source that offers Slack channels as you type, showing up to 10 matches formatted as #channel. Nothing in this build was found to switch it on, so whether it appears depends on how the Slack integration is enabled.

Two server-controlled flags appeared. tengu_cobalt_plinth_moss (fallback on) gates the guard around automatically reading artifacts; with it off, the path logs artifact_guard_autoread with "gate_off" and does nothing. tengu_scalable_quiche (fallback off) gates subscribing to a watched URL or trigger; with it off, the subscribe call returns skipped with reason "flag_off" unless that item is already being watched.

A watch on an artifact can return on a "durable wake" path: rather than holding a live subscription and receiving streamed updates, the session registers a trigger and is woken with a new turn the next time that artifact is published. The tool result explains which of the two you got. The watch data gained rail, trigger_id, durable_since, status and note fields. None of this exists in v2.1.226.

Four events cover the new worker sync: tengu_dir_sync_worker_pull and tengu_dir_sync_worker_push carry per-turn counts of files considered, filtered, applied, already equal, conflicted, stale, failed and deferred, while tengu_dir_sync_worker_base and tengu_dir_sync_worker_rehome cover the initial scan and workspace re-pointing.

When a memory citation tag is stripped from assistant output, the event now reports how many of the cited filenames matched known memory files, how many had been read or written, and how many were injected into the prompt, surfaced, or only listed in an index.

New bookkeeping records how each memory file arrived (in the prompt body, surfaced, merely listed, or not at all) and whether it was later read, written, or both, then matches a memory the model names against that set. It exists to judge whether a cited memory was actually available; nothing new is shown to you.

Setting ENABLE_TOOL_SEARCH to force pins tool search to its search-based mode and skips the "standard" fallback that would otherwise apply. The value is now read from the environment Claude Code composes from your settings, not just the raw process environment. The override is refused under HIPAA mode and for non-first-party model providers.

Time spent actively working is now written to disk, so break reminders can survive a restart. The ledger lives in active-time.json in the config directory, or under an active-time-ledger key when a storage backend is present, and holds start, end and active-seconds windows pruned to one year. Reminders themselves still only fire when the breakReminder.enabled setting is turned on, documented as defaulting to false, alongside the existing breakThresholdMinutes.

The settings description for the cloud gateway login URL no longer marks itself internal and now states that the value is read only from admin-controlled managed settings (MDM, managed-settings.json, or the policy helper) and ignored if it appears in user, project, or remotely delivered settings.

OIDC configuration accepts a new optional use_proxy boolean. Set it to true and requests to your identity provider go through HTTPS_PROXY/HTTP_PROXY. Leave it out while a proxy is configured and Claude Code now warns that those requests currently go direct and will follow the proxy by default in a future release, pointing you at oidc.use_proxy: true to adopt the new behaviour now or false to silence the warning.

Setting CLAUDE_CODE_DISABLE_PRECOMPACT_SKIP makes Claude Code read the whole transcript after a compaction boundary instead of skipping that work on large files. Unset, the skip stays in place.

A new modelProposedGoals setting controls whether Claude may propose session goals, with values auto, alwaysAsk and disabled. auto (the default when unset) lets the model decide per proposal whether to ask you; alwaysAsk routes every proposed goal through the approval dialog; disabled turns the feature off. Because it affects consent, it is read only from user, policy and command-line settings, and project or local settings are ignored.

The tool that manages scheduled cloud agent routines gains two actions: list_runs, which returns the routine's recent runs (id, title, status, timestamps and a claude.ai link, most recently active first), and get_run_log, which returns the newest 200 events of one run. New session_id and cursor parameters go with them.

Workflow scripts can pass agent(prompt, {bashCommandClamp: [...]}), a list of Bash(<command or prefix>) rules that the spawned agent's shell use is restricted to. Any Bash call not matching every clamp group is denied with "bashCommandClamp: no clamp rule matches this command", and a command whose structure cannot be taken apart (command substitution, control flow) is denied as unverifiable.

In auto permission mode, when a tool is held for approval only because it touches a directory outside the session, Claude can look up the other working trees linked to the same repository and retry the check with those included. The resolver returns nothing unless tengu_auto_mode_worktree_fast_path is on, and it falls back to off, so behaviour is unchanged in this build.

The cap on how many turns Claude takes automatically is read from a new remote-config key, tengu_sorrel_trellis_weir. No value from the server means the built-in default of 60 applies, and a session-level override still wins over both. Values that are not positive numbers are ignored.

The attribution header sent with API requests can now include a prompt id alongside the existing previous-request id. Each is emitted only if it matches a strict shape, a req_ prefix for the request id and a UUID for the prompt id, and only under first-party auth. Setting CLAUDE_CODE_ATTRIBUTION_HEADER suppresses the header entirely.

/review now accepts --post and --no-post. For a cloud review of a GitHub.com pull request, --post publishes the finished findings as a single comment from your own GitHub account. Interactive sessions still confirm in the launch dialog; non-interactive runs post on the flag alone. Posting is controlled by the server flag tengu_ultrareview_post_enabled, which defaults to on when the server says nothing.

The Artifact tool's instructions now state that only the first 8KB of the file is scanned for the <title>, so a title further down will be missed. The guidance for updating an artifact from an earlier conversation was rewritten: find its URL with action: "list" or ask for it, because publishing without url creates a new artifact instead of updating the old one.

MCP_TIMEOUT and MCP_CONNECT_TIMEOUT_MS are now capped at 2147483647 milliseconds. Values above that used to overflow the underlying timer and expire immediately; defaults remain 30000 and 5000 milliseconds.

If you type --post but the review runs locally, Claude Code says so in one short line and points you at --comment, which is the flag that posts local findings as inline PR comments. --post applies only to the cloud /code-review ultra path.

When a request is refused because sandboxing is disabled on the device, the message now includes the exact settings to add, "sandbox": {"enabled": true}, and points at the /sandbox command to check the current state.

A native clipboard component is now built into the binary. On Linux, if none of wl-copy, xclip or xsel is installed but DISPLAY or WAYLAND_DISPLAY is set, copy and paste now fall back to this built-in component instead of failing.

Job deletion now reports an "occupied" outcome instead of removing the worktree when it is the working directory of a live process. The message distinguishes a session you backgrounded from this window, a background session with a job id, and a bare process id and kind.

Failures writing to the output stream, and rejections from a headless run, no longer end the process silently. Claude now prints a truncated human-readable reason to stderr, emits it as a stream-json message where applicable, and exits with code 1.

If a message cannot be written to the headless output stream, Claude now writes an Error: line to stderr, marks the turn's summary as failed, and in stream-json mode emits a result object with an error_during_execution subtype built by a shared helper.

Outside verbose mode, an over-long tool result is now cut short and followed by a note that the full text still went to the model. Nothing is hidden from Claude, only from your screen.

An optional alternative storage handle, referred to internally as storage v5, is now passed into plugin install and marketplace code, MCP server commands, settings writes, session and history reads, daemon and terminal bookkeeping, theme writes, task registries and dozens of UI components. Mentions went from 37 to 689. Every call site still falls back to reading and writing files directly when no handle is supplied, and nothing in the source shows what decides whether a run gets one.

An optional storage handle now threads through session and transcript loading, MCP reconnect, plugin loading, daemon and background jobs, team files, scheduled tasks, memory directories and agent sidecars: mentions grow from 37 in v2.1.226 to 689 here. Every call site branches on whether the handle exists and otherwise takes the existing filesystem path. The only factory that would create one returns nothing regardless of its tengu_hover_rest gate, which itself falls back to off, so behaviour is unchanged everywhere.

An optional storage handle, a namespaced key/value store used in place of direct file reads and writes, is now passed explicitly into settings loading, plugin and marketplace commands, MCP task restore, background and fleet jobs, teammate mailboxes, the LSP manager, transcript reads, migrations, the REPL and most dialogs. Nothing changes on this build: it is built only when the tengu_hover_rest flag is on (default off), and the factory returns nothing even then, so every call site falls back to the existing filesystem path.

Gateway configuration gains a pricing block with a multiplier (greater than 0, at most 1) and an overrides array of {upstream, model, input, output, cache_read, cache_write}, applied by the spend meter.

The proxy configuration file now takes an optional pricing block. It holds a multiplier that must be greater than 0 and at most 1, defaulting to 1, plus a list of per-upstream, per-model overrides for input, output, cache_read and cache_write rates. The block is absent by default, so pricing is unchanged unless you add it.

The tengu_velvet_cascade remote config, a JSON object listing models that should use the simple system prompt, is gone from the build. The choice now rests on the per-model capability entry, the CLAUDE_CODE_SIMPLE_SYSTEM_PROMPT environment variable, and the existing tengu_velvet_tide escape hatch.

The terminal renderer reads CLAUDE_CODE_DEBUG_REPAINTS and only captures per-component debug ownership information when it is set, so normal sessions skip that work. Layout caches also moved onto the nodes themselves.

Setting CLAUDE_BG_BACKEND=daemon now makes the terminal renderer tolerate stdout going away instead of treating it as fatal.

On remote runs, startup phase timing can merge a JSON blob from the CCR_RUNNER_STARTUP_TIMING environment variable into the reported figures, validating each field for type, range and pattern: names must be lowercase with underscores, and numbers and phase durations are capped. Prewarm, prefetch and delta-reset values from the environment are reported alongside. Nothing is reported unless CLAUDE_CODE_REMOTE is set.

Choosing a shared project memory in /memory, or turning it off, now runs a full switch: it waits for the connection to settle under a deadline, then shows one of switched, connected, disconnected, unavailable, pending or unchanged. It also tells the model that any memory results it saw earlier are now stale, so it stops relying on them.

/mcp now spells out cross-session cases that previously looked like bugs: a server re-enabled elsewhere so your disable did not stick, a server disabled elsewhere that needs a disable then re-enable in /mcp to reconnect, a server disabled elsewhere that is not configured here, and a server still running in this session that will not come back after restart.

/mcp reconnect all and the enable/disable flows now add a single summary note when servers were changed from another running session, for example that N servers were re-enabled elsewhere so your disable did not stick. Previously only per-server versions of these sentences existed.

The agent() spawn API gained a bashCommandClamp option: a list of Bash(...) permission rules that limits which shell commands the spawned agent may run. It is checked strictly at spawn time, so a malformed list, an entry that does not parse as a Bash rule, or one with empty or space-padded contents aborts the spawn instead of quietly running the agent with no clamp.

Terminals that send BS (0x08) for the backspace key now register as backspace. Previously only code 127 was mapped, so those terminals produced an unrecognised key.

"Unable to connect to API (CODE)" is replaced by distinct messages per socket, DNS and proxy error: dropped connections, refused connections with a firewall or proxy hint, unreachable hosts, no route to host, and failed proxy tunnels. Unrecognised codes still get the old generic wording.

Running the gateway subcommand, which starts the enterprise auth and telemetry gateway, now makes Claude Code report "gateway" as its provider. Previously that only happened when gateway credentials were present.

Timing marks, memory snapshots and the timeline dump only run when CLAUDE_CODE_PROFILE_QUERY is set, so ordinary sessions no longer collect them.

Command definitions gained a subcommandsBareOnly field. When it is set, a subcommand name only matches if nothing follows it, so typing /foo bar baz runs the parent /foo command with bar baz as its arguments instead of dispatching to the bar subcommand.

/mcp reconnect all no longer stops at the first thing it finds. It now combines the count of disabled servers, servers that are not connected and servers that are not configured into a single message. /mcp enable all reports the same not-connected summary.

When the review fails to poll or the remote returns an error, the CLI now states outright that no comment was made on the pull request, including when a --post run ends that way.