Claude Code v2.1.228

A side panel showing uncommitted changes is built into the REPL, with /diff toggling it rather than opening the existing dialog. It has a file list, a section for changes made before this session, a filter that hides test and generated-file noise, cycling of the comparison base, and an "Ask about selection" action that sends a selected hunk into your prompt. It sits behind the tengu_willow_crate gate, whose fallback in this build is false, so nothing changes without a remote value enabling it.

The bundled claude gateway gains a cri config block. With cri.enabled: true it accepts Claude Enterprise callers presenting Anthropic-minted CRI tokens, checked against an organization allowlist you supply, and the oidc: sign-in block becomes optional so a gateway can run with no identity provider at all.

The gateway server can now accept requests authenticated by cri+jwt-typed ES256 tokens instead of a shared key. Turn it on with cri.enabled: true in the gateway config. Tokens are verified against keys fetched from https://api.anthropic.com/api/oauth/cri, must carry the inference scope and belong to an allowlisted organisation. If the keys cannot be fetched the gateway answers 503 with jwks_unavailable.

The deprecation-date table gains 3.5 Haiku, Opus 4 and 4.1, Sonnet 4 aliases and snapshots, and claude-mythos-preview, so those models report a concrete date instead of none.

Responses can now contain blocks of type fallback (the point where the API switched models) and mid_conv_system. Token accounting, block dispatch and the streaming handler all handle both explicitly, counting them as "other" tokens and returning quietly rather than treating them as unknown. An additional 400-error classifier also now recognises the effort_unsupported upstream error class.

The self-hosted gateway can accept callers that present an external identity token rather than a user sign-in, configured by a new cri block with enabled, audience, issuer and org_allowlist. It is off by default (cri.enabled false). When on, discovery advertises cri_enabled: true, audit and inference records are tagged with upstream_kind, and these callers skip managed-settings policy matching entirely.

Attaching to a remote session now checks first whether that session is bound to one device, and registers only when egress is available, an account uuid is present and the local device id matches. Every outcome is reported as tengu_device_bind_attach with a result such as bound, egress, account, no_device_here, other_device, session_unbound or session_unreadable. The whole check sits behind an enable predicate; when it is false or throws, the result is disabled. Nothing in the build sets that predicate's effective value, so it is decided outside the source.

Skills can now come from your claude.ai account as a first-class source alongside local, bundled and plugin skills. Fetching them is off unless you set CLAUDE_CODE_SYNC_SKILLS, or set CLAUDE_CODE_SYNC_SESSION_REFS with a session id latched in CLAUDE_CODE_SESSION_ID. Neither the source label nor the provenance value exists in 2.1.227.

Two new skills that publish a live, editable Artifact are registered at startup: a word-processor-style document and a spreadsheet with a formula bar, sorting and per-cell saving. Nobody can invoke them here. Their enable check is a build-time constant that always returns false, not a remote flag, so no account or setting turns them on in 2.1.228.

Requests to the memory store API now send the beta value agent-memory-2026-07-22 instead of managed-agents-2026-04-01. If your proxy, gateway or deployment allow-lists the old value for memory traffic, it needs updating.

Publishing from a Cowork session can no longer be auto-approved. The safety check now states that publishing sends session content to a web-reachable page, and if there is no live surface to ask a human on, the publish is denied outright with instructions not to retry it in that session.

Whether Write may touch a file you have not read was previously switched by a server-side flag; that flag is gone from the build and the rule is now fixed in the client. Writing without a prior Read is allowed only for non-.ipynb files, only for models outside a listed set (including claude-opus-4-5 and claude-sonnet-4-5), and only when reading that path is already auto-allowed by your permission rules. A file you read only as a partial view now always triggers the error.

The bundled Anthropic SDK gained a full worker runtime that polls a server for agent work and runs it locally. It is present in every install but only runs under managed-agents flows, which nothing in normal CLI use enters.

A new routine asks the API for the list of models, records a capability entry for each and saves them. Two guard checks run before any network call and one of them short-circuits it entirely in this build, so no fetch happens. Failures log a single line.

The bundled Anthropic client gained resource classes for deployments (with archive, pause, run and unpause), deployment runs, dreams (with archive and cancel), tunnels (with certificates, token reveal and token rotation) and webhooks. They are registered on the client and send the managed-agents-2026-04-01 beta header, but no Claude Code command or UI path calls them in this build.

A new message origin kind for Slack pings is wired through message display, prompt queueing, system-reminder wrapping and harness tag neutralisation, with its own equality check over channel, thread, message, Slack user, sender name and permalink. No code path in this build produces an origin of this kind.

New client resources are compiled in: deployments and session thread events with streaming (managed-agents-2026-04-01), dreams (dreaming-2026-04-21), tunnels and tunnel certificates (mcp-tunnels-2026-06-22), memory-store versions including redaction (agent-memory-2026-07-22), a binary skill-version download, and an MCP OAuth validation call on vault credentials. Messages, batches and token counting lift a user profile id field into a header.

A new environment variable, CLAUDE_CODE_COWORK_FRAME_ARTIFACTS, turns off the "you already approved this in this session" shortcut for artifact database writes and republishes, so each of those decisions is made fresh. It applies only on the local-agent entrypoint and only when CLAUDECODE is not set, and artifact actions fail closed with frame-specific denial text when a permission check cannot complete.

The skill loader now makes a second pass over your user settings directory, loading skills from syncedSkills alongside the usual skills. Skills from there are labelled "synced" as their owner in the skill list and in / command entries.

/diff has two behaviours in this build. With the tengu_willow_crate gate on, the command is described as "Toggle the diff panel showing uncommitted changes" and actually opens and closes the diff sidebar. With it off, which is the in-source fallback, the old description stays and the handler does nothing. Absent a remote config value saying otherwise, you get the old behaviour.

The per-turn file sync with a cloud session now pulls as well as pushes, and narrates what it did in plain language, with lines beginning "Pulled " or "Synced " and warnings such as "the session's file budget is used up" or "names that differ only by case". It runs only when the flag tengu_violin_wood is on, which falls back to off, and only for directories whose sync mode is container_sync.

New code drives a side panel that toggles between a diff view and the conversation, and cycles what the diff is compared against: the session's starting point, uncommitted changes, or the branch. Both the tab switch and the base switch emit telemetry. Opening is gated on the diffSidebarOpen setting, needs a terminal at least 144 columns wide unless that setting is explicitly true, and reports a message when the directory is not a git repository. The chosen base persists as diffSidebarBaseMode.

Turning off artifacts now honours CLAUDE_CODE_DISABLE_ARTIFACT and the disableArtifact setting, which is what the settings schema documented. The check previously read the Workflows environment variable and setting instead.

Installing plugins in headless mode now re-fills the plugin cache after each change instead of leaving it stale, without blocking the install. Set CLAUDE_CODE_SYNC_PLUGIN_INSTALL to skip the background work entirely; it is also skipped when a cache-only load is already pinned.

The AWS Bedrock backend was rebuilt. It no longer swaps in a custom stream class; instead it rewrites each outgoing request and translates Bedrock's binary event stream into a standard server-sent-events response, so streaming and errors behave like every other backend.

When a request falls back to a different model mid-stream, the model shown to the client now matches the one that actually answered.

Claude Code no longer sends a candidate shell command to a model to work out its safe prefix before running it. That means one fewer round-trip and one fewer thing that can stall or fail before a command starts. The prefix is now derived locally from the already-parsed command.

On resume, a bridge session that was reaped is unarchived first and then reattached, so resuming an older session works instead of failing. Controlled by tengu_bridge_unarchive_on_resume, which defaults to on in this build.

If the remote control connection closes with code 4090, meaning the session's registration on the server went stale, the client now re-registers and resumes instead of treating the session as lost.

Bash permission decisions no longer make a model call to extract a command prefix. The prompt, its command_injection_detected escape hatch and its example list are absent from the bundle, along with the caching class that drove it.

When the CLI restarts itself, it now passes --model with the model you had selected, so an update relaunch or a renderer switch no longer drops you back to the default model.

Three new notification texts can appear alongside the existing "Auto-edited Artifact:" messages: one saying an artifact's auto-edit needs review, one saying auto-replies are paused, and one saying a publish re-enabled them. Each names the artifact.

The gateway gained an optional identity-verification block named cri, with settings for the expected audience, an allowed-organisation list, and the key and issuer URLs used to check tokens. It only runs when cri.enabled is set to true in gateway config; otherwise the boot path is unchanged.

The gateway config schema now accepts a cri block for customer-routed inference, with enabled defaulting to false, plus audience, issuer, org allowlist and an optional policy webhook. Validation is strict: the issuer must be canonical https with no query, fragment or trailing slash, because the key URL is derived as {issuer}/jwks.json. Loopback issuers require CLAUDE_GATEWAY_ALLOW_LOOPBACK. Allowlist entries that are not UUIDs warn that every caller from that org will be denied.

Attaching to or resuming a remote session can create or take over a directory-sync session on your laptop, with outbound messages held until the sync has posted. Gated by tengu_violin_wood, which is off in this build, so nothing changes unless the server turns it on.

Feedback drafts, workflow journals, the installed plugins file, marketplace manifests and catalogs, and the global config all gained a path through a v5 storage backend, taken only when that backend and a valid key are present on the call. Nothing in this build forces it on, so which path runs depends on how the backend is provisioned. Everything falls back to ordinary files otherwise.

Fetching comments on an artifact can go through a new server-side path, falling back to the existing frame-host URL flow if the server call errors. The switch is tengu_onyx_sluice and its built-in default is off, so unless a remote configuration value turns it on, nothing changes for you.

The bundled Anthropic client swapped its memory-version endpoints for /v1/deployment_runs?beta=true, added a threads resource, and now removes user_profile_id from message, token-count and batch-create request bodies before sending.

claude gateway no longer requires OIDC configuration. With it absent, the device authorization endpoints return 404 "not found", discovery advertises no supported grant types, and the Google groups warning is suppressed. Upstream errors 413 and 501 now get readable messages.

Settings now take a policyHelpers object keyed by macos, linux, windows and wsl, alongside the existing single policyHelper. A bad individual entry is ignored with a status warning, but a structurally invalid policyHelpers object coming from an OS-admin policy source stops startup.

Administrators can now set a different policy helper executable per platform. policyHelpers is an object keyed by macos, linux, windows and wsl; the entry matching the current platform wins over the existing single policyHelper, and a platform with no entry falls back to policyHelper. A wsl machine with no wsl entry tries the linux entry first.

The task_started system event in the SDK stream now includes owned_by_subagent, so consumers can tell tasks a subagent owns apart from tasks the main thread owns. The session runner tracks the owned task ids alongside it.

The action that switches which revision the diff panel compares against now has a default key binding, ctrl+x b, active while the diff panel is focused. It existed in the previous build with no key attached, so it was unreachable without a custom keymap.

The extraKnownMarketplaces setting is now deep-merged across settings layers, so a project or managed-policy file can add a plugin marketplace without wiping out the ones defined at user or enterprise level.

Requests to AWS endpoints with query parameters are now signed with those parameters included, so signatures over such URLs should match instead of being rejected.

Inbound user activity over the SDK and streaming input now counts against the idle timer. Previously a session could be treated as idle while the user was actively interacting.

Scanning stored transcripts for resumable sessions now skips journal entries and any entry belonging to a different project, so the list you are offered stays within the current project.

A layout pass that throws while drawing the interface is now retried immediately rather than taking the session down. If the retry also throws, that single frame is dropped and an error is reported.

When the model emits tool input JSON that will not parse, the failure is caught while streaming, the input is replaced with an empty object, and you get a readable message quoting the bad JSON rather than the stream blowing up.

A Read deny rule in your permission settings now blocks writes as well as edits. Attempting to write such a file fails with "File is covered by a Read deny rule in your permission settings and cannot be written." No flag involved; this applies to everyone on this build.

Both templates embed a common set of marked regions for saving, comments, editing and styling. Edits save back into the artifact block by block, and the save indicator only claims the change is persisted after the server accepts the commit, showing a local-only state otherwise.

An artifact reading or writing the data/users collection can use the document id me and it is rewritten to the caller's real user id. The id is fetched once and cached per account, with concurrent lookups sharing one request.

Paths equal to or under data/users/me in the artifact database tool are now rewritten to data/users/<your id>/.... The id is fetched by a new "whoami" request with a 15 second timeout, cached per account, with concurrent lookups sharing one request.

The bundled Anthropic client constructor now takes a webhookKey option that defaults to the ANTHROPIC_WEBHOOK_SIGNING_KEY environment variable, or null when it is unset. Previously that variable appeared only in bundled documentation and no client code read it.

On self-hosted runners, a background task that has finished still counts as in-flight until the next turn reads its result, so drain and shutdown wait for it. The window is capped by SELF_HOSTED_RUNNER_BG_RESULT_GRACE_MS in milliseconds; setting it to 0 or an unusable value falls back to the default, so the hold cannot be turned off.

The SDK control request for a host auth token refresh now resolves the whole control response rather than pulling the token field out of it, leaving that to the callback. The refresh callback is only registered when CLAUDE_CODE_SDK_HAS_HOST_AUTH_REFRESH is set, so nothing happens here otherwise.

CLAUDE_CODE_MAX_RETRIES, MAX_MCP_OUTPUT_TOKENS and CLAUDE_CODE_SESSIONEND_HOOKS_TIMEOUT_MS are now checked for being finite numbers before use. A non-numeric or infinite value falls back to the built-in default instead of corrupting the retry count, the MCP output token budget or the SessionEnd hook timeout.

The unused-skills report adds a category for synced skills that have never been invoked, alongside the existing owned, plugin and MCP skill categories.

When the layout engine throws while measuring the terminal UI, Claude Code now clears its cached layout for the whole tree and retries once. If the retry works the frame draws normally; if it throws again that single frame is dropped and the session carries on instead of crashing. This is in the normal render path for everyone on this build, not behind a flag.

The SDK debug logger now mints a session id of the form sdk-<uuid> at startup and, when the caller hands it a storage handle, appends through that instead of writing the file directly. With no handle it writes to the same debug file as before. Only runs when DEBUG_CLAUDE_AGENT_SDK is set.

One flush-interval call site now reads CLAUDE_CODE_DATADOG_FLUSH_INTERVAL_MS. The older CLAUDE_CODE_DD_ERROR_TRACKING_FLUSH_INTERVAL_MS is still registered and still read elsewhere, so both names are live and set whichever the call site you care about uses.

The getHostAuthToken control response gains an optional materialUnchanged boolean. It is only consulted when authToken is null, meaning the credential was delivered out of band; setting it true tells Claude Code to fail fast instead of backing off and retrying.

Running /diff when the diff sidebar cannot be opened now prints a message instead of appearing to do nothing.