Claude Code v2.1.229

Claude can be told to say what it is about to do before starting, post brief progress updates while working, and write a final message that stands alone. Set CLAUDE_CODE_TURN_UPDATES to turn it on or off yourself; otherwise it is decided by a per-model capability check, then by a capability map the server sends with your account data. It replaces the usual communication guidance in the system prompt rather than adding to it.

A third artifact family joins doc and sheet: a presentation deck, with a full skill body and a published-deck template offering a thumbnail rail, in-place slide editing, comment threads kept in a hidden storage block, and a Present mode. It is registered as a user command described as "Publish a presentation deck Artifact", but the registration's isEnabled function returns false in this build, so the command cannot be reached.

A large new bundled skill drafts designs as .dc.html artboards laid out on a single pan-and-zoom canvas and publishes them as an Artifact, with an editor built into the published page. Saving republishes for everyone only where the artifact grants the self-write capability; otherwise the page is view plus PNG and PDF export. It registers a design slash command. Off in this build: it needs tengu_ethereal_nova, which falls back to false, and an Artifact tool that advertises capabilities.

Sessions running in remote mode can now be handed out-of-band events while a turn is in flight (GitHub webhook activity, a scheduled trigger firing, a message from another Claude session). They are buffered and Claude is nudged to call a new tool, ReadNotifications, until it reports 0 remaining. This needs remote mode, set through CLAUDE_CODE_REMOTE plus an internal remote check; payloads arriving otherwise are dropped.

The teleport menu gained "Continue this session in the cloud", which hands the current session to a cloud session and then either reconnects Remote Control to it or disconnects. It refuses unless Remote Control is active, you are logged in to claude.ai, and you are in a git repo with a clean tree and nothing unpushed. Available where /teleport already is, which needs the allow_remote_sessions remote setting.

A new read-only tool called ReadNotifications lets the model pull notifications the server has queued for a session (GitHub activity, scheduled triggers and messages from other agents), oldest first, marking them delivered and reporting how many are left. It is only offered when the CLAUDE_CODE_REMOTE environment variable is set and the session is non-interactive, so it does not appear in an ordinary terminal session.

The check for Harbor cross-session messaging was rewritten. Setting CLAUDE_CODE_HARBOR_KITE now forces it on regardless of platform. Windows, which previously always returned false, is allowed through when the separate tengu_harbor_kite_win gate is on. The general gate is consulted last. Both gates fall back to off in this build, so unless the environment variable is set, whether it runs is decided by remote config.

Subscribing to an artifact now returns which events it covers, and the status line says whether you will be woken on republishes only or on republishes plus comments addressed to Claude.

A command named "commit" is registered that gathers git status, the diff against HEAD, the branch and the last 10 commits, then follows a fixed workflow: never amend after a failed pre-commit hook, never use --no-verify, prefer naming files over git add -A, and never push unless asked. Its tool access is limited to git add, status and commit. It appears only when the tengu_cinder_relay gate resolves true; the value compiled into the build is false, so whether it shows up is decided by server config.

A new pr command gathers git context and opens a GitHub pull request through a fixed gh CLI workflow, with a fixed allowed-tools list covering gh pr create --title --body and git push -u origin * and a heredoc body format. Off in this build: it needs tengu_cinder_relay, which falls back to false, behind the commit-skill rollout gate. The old pr-explainer command that generated a shareable PR walkthrough artifact is gone, and PR review skills no longer point at it.

When five-hour usage crosses a threshold, and you are not using or allowed extra overage, Claude Code arms a one-shot hint that tells the model to finish the current step, list at most 3 bullets of the most impactful remaining work, and not start subagents or long-running work. Off in this build: tengu_vellum_anchor falls back to false. Reports as usage_limit_near_wrapup.

When you hit a five-hour limit and the reset time is known, Claude Code can queue your turn to resume after the reset and show a hint line ending in " to continue after reset", or prefill continue into the prompt. Choosing "adjust" or "upgrade" from the rate-limit or spend-limit menu cancels the queued continue; cancelling or choosing "wait" prefills it instead. The whole path is behind the tengu_vellum_anchor flag, which falls back to off, so nothing in this build turns it on locally and whether it appears is decided by server config.

When five-hour usage crosses 95% and the account is not in overage, Claude gets a message telling it to checkpoint: finish the current step, list up to three bullets of the most impactful remaining work, and start no subagents or long-running work. A usage_limit_near_wrapup event is recorded. The whole path is behind the tengu_vellum_anchor gate, which falls back to off, so with no remote config value nothing is injected.

The builder for the attribution header now takes an options argument, and one specific first-party, non-unix-socket path passes ignoreEnvOptOut, which makes the header be sent even when CLAUDE_CODE_ATTRIBUTION_HEADER is set to opt out.

The auto-mode classifier, the two-stage classifier and the critique query now force the billing attribution system block to be sent even when the opt-out environment variable is set. It carries version, entrypoint and workload metadata, not conversation content, and is only sent on the first-party API and never over a unix socket.

The prototype skill names three fidelities, sketch, clickable and wired, defaults to clickable, and states its pick instead of asking you. If you explicitly ask, it can prototype a feature on top of an existing app, either as a screenshot overlay or a shell built from your repo source. A new hand-off step converts the finished prototype into an approved brief split into must-have, nice-to-have and cut.

The [1m] long-context model variants were hidden from subscription accounts whose credit state disallowed extra usage. That credit check now applies only when you are talking to Anthropic's own endpoints or a local socket, so subscription users pointed at a custom ANTHROPIC_BASE_URL see the 1M variants offered. Setting CLAUDE_CODE_DISABLE_1M_CONTEXT still hides them everywhere.

The background worker that syncs directory contents now starts only when a decision helper allows it, and CLAUDE_CODE_DISABLE_DIR_SYNC feeds that decision alongside the entrypoint being used. When it is skipped for that reason, a telemetry line records it.

The built-in allow-rule suggestions are now argument-specific: git commit -m , gh pr create --title --body and gh pr edit --title --body *. Approving one no longer blanket-allows arbitrary commit or pull-request flags.

Telemetry export now decides per signal (metrics, logs, traces) whether to send OTLP data to a gateway endpoint derived from ANTHROPIC_BASE_URL, authenticated with a Bearer header from ANTHROPIC_AUTH_TOKEN. It only does this when CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is set, the auth mode is first-party/gateway, the token is scoped to the gateway audience, you have set no OTLP headers of your own, and your OTLP endpoint already matches the derived URL. Any other combination sends nothing.

The pipeline that reacts to comments on published artifacts now records a status for each comment thread rather than just succeeding or vanishing: declined with a reason such as blocked, auto_reply_off, plan_mode, hourly_cap, loop_guard or denied_by_rule, or failed with compose_failed or post_failed. Threads seen for the first time can be deferred instead of dropped. Nothing in the build resolves whether the surrounding auto-reply feature is on for a given account.

Artifact database guidance documents an exception to shared rows: each viewer's subtree under the data/users/ prefix is private to that viewer, and the literal path segment me stands for the current viewer's id, the same one the page gets from claude.user.id(). It requires the published version to declare the user capability alongside db. The paragraph is only included in the tool description when its internal flag is set.

Publishing an artifact gained an optional session_context parameter, an error when it is missing on a first publish, and capture of the prompt that triggered the publish (truncated with a marker) plus the model into the published metadata. It all sits behind a latch that is initialized to false in this build, so the parameter is never offered and the requirement never fires.

In remote sessions, watching a published artifact can now register a wake that fires on new comments as well as republishes, and the tool text was rewritten to match. The whole durable wake path is behind a remote-config flag whose built-in fallback is false, so it is off unless the server turns it on, and it also requires the remote-session mode.

CLAUDE_CODE_ARTIFACT_VIEWER_BASE_URL is a new recognised environment variable, and artifact URL parsing and building now ask a resolver for the viewer host instead of assuming claude.ai or the staging host. In this build that resolver has an empty body and returns nothing, so the variable is never read and URLs still resolve to the built-in hosts.

Helpers were added that would inject plain-language PR writing rules ("Short beats complete"), fetch the repo's PR template out of git, and warn that the template is untrusted content. All of it sits behind a helper that unconditionally returns false in this build, so none of it reaches any prompt.

The artifact publish tool can offer a session_context field holding context saved with the published version so a later session can pick up where you left off. The condition that adds it reads an internal flag that starts false and is never set anywhere in this build, so the field is never offered.

Remote sessions can now receive a queued_notification message, which previously fell through as an unknown message type and was logged and ignored. Payloads are validated and size-capped, and an oversized one is refused without acknowledgement. The feature is only advertised when the CLAUDE_CODE_REMOTE environment variable is set and an SDK transport is active.

The message types Claude Code emits on stdout gained a queued_notification entry carrying an id, origin, content, a priority of "now", "next" or "later", and a queue timestamp. It is the wire format behind the ReadNotifications tool: the CLI buffers the event, nudges the model to drain it, and only acknowledges it once drained, so an undrained event is redelivered when the session resumes.

Comments on an artifact can now carry the file they refer to and a hash of that file's contents, alongside the existing path and quoted span, so a comment stays tied to what it was written about. The schema also records when the anchor has degraded.

A large refactor across config writing, hooks, the status line, file suggestions, notifications and MCP elicitation: each now receives the session, its project root and cwd, or a storage handle as an argument instead of reading ambient globals, and the remaining shared state sits behind accessor objects. Groundwork for running more than one session correctly in a process.

The SDK event that fires when work from a session goes out for review is now described in provider-neutral terms, with the provider field documented as carrying other values for other review systems and the URL as the published change rather than a PR link.

Building and parsing artifact URLs now checks a configured origin override first and falls back to CLAUDE_AI_ORIGIN, so artifact links point at a custom host when one is set.

A plugin marketplace entry can now use source: "command", a shell command that prints the absolute path of a plugin directory on stdout and exits 0. Claude Code copies that directory into its plugin cache, or links it in place with mode: "link". The command has a timeout in seconds, default 60 and capped at 600. Administrators can block it entirely with the managed settings disableCommandPluginSources or allowManagedHooksOnly.

Plugin sources now include command: a shell command that prints the absolute path of a plugin directory. It is re-resolved on install, on update and once per session in the background, takes an optional timeout, and a mode of copy or link decides whether the directory is copied into the plugin cache or used in place. Installing one asks for consent first.

A marketplace can now declare a command plugin source, where Claude Code runs that command on your machine to produce the plugin directory. Installs and updates prompt before running the command. A new managed setting disableCommandPluginSources turns it off; when it is unset, the existing allowManagedHooksOnly managed setting decides, and an invalid value for either key is treated as disabled.

A settings file inside the repository root that sets disableAllHooks: true is now recorded during settings traversal, and the self-hosted runner path honors it.

Starting a self-hosted runner on Windows without a base directory now fails with an explanatory error instead of silently falling back to a POSIX container path that does not exist there. Set --base-dir or the SELF_HOSTED_RUNNER_BASE_DIR environment variable to the directory repositories should be checked out under. The runner also now passes CLAUDE_RUNNER_CLIENT_PLATFORM into spawned runner environments, parsed as client_platform.

When several workflow agents start with an identical prompt prefix, the followers now wait briefly for the leader's first response so their request hits the prompt cache instead of paying full price for the same prefix. The wait is capped by CLAUDE_CODE_WORKFLOW_PREFIX_STAGGER_MS, which has a built-in default when unset and is forced to 0 when DISABLE_PROMPT_CACHING is set.

Both subcommands accept -y/--yes, which accepts a plugin whose install method is a command declared by its marketplace without showing the interactive confirmation. It is required when stdin or stdout is not a terminal, and it is refused with an explicit message if you run it from inside a Claude Code session.

After a successful login, if CLAUDE_CODE_OAUTH_TOKEN was set when /login started and the gateway is not in use, the success message now notes that new sessions will keep using the old token until you remove it from your shell profile or settings file.

When sandbox initialization fails, it now clears its recorded state and returns instead of caching a rejected promise, so a later attempt can succeed. A successful init clears the previous failure reason.

On an HTTP 413 from the API, Claude Code now measures the request body and how much of it is images and documents, then tells you whether removing attachments or compacting could make it fit or whether nothing in the request is strippable.

Git subprocesses now run with GCM_INTERACTIVE set to "never", alongside the existing GIT_TERMINAL_PROMPT: "0" and GIT_ASKPASS, so a Windows Git Credential Manager dialog cannot block a git command indefinitely.

When an MCP server signs you in through your browser, the local address it redirects back to is now http://127.0.0.1 rather than http://localhost. This fixes sign-in on machines where localhost resolves to the IPv6 address ::1 and nothing is listening there.

After a background auto-update, Claude Code tries to re-resolve plugin commands in the running session. The notification now says "reloaded for this session", or "reloaded with errors — see /plugin", and only falls back to the old "Run /reload-plugins to apply" when the reload was skipped or failed.

The built-in "Commit, push, and open a PR" command ships an explicit deny list, so Claude cannot reach for the flags that would rewrite history or redirect a PR while running it.

A system prompt was added for a dispatched subagent that reads exactly one comment thread on one published artifact and writes a plain-text brief whose first line must be exactly "ANALYSIS BRIEF". It replaced an unrelated read-before-edit reminder in that slot.

A new module defines a frozen list of hosts, covering GitHub and its api/codeload/raw/objects variants, pypi.org, files.pythonhosted.org, registry.npmjs.org, anthropic.com, claude.ai, claude.com and ant.dev, along with a size cap and a host-character pattern. Nothing in this build references any of it, so it has no effect today and reads as groundwork.

Once per session, a plugin installed from a command can be re-resolved in the background. This needs non-essential network traffic to be allowed, the resolved path not to be the current project, and a remote-config flag whose built-in fallback is on.

Sandbox domain and injectHosts entries are now normalized and checked for bracketed IPv6 spellings, ports and canonical form. Entries with unreliable spellings still work, but enforcement becomes conservative: it denies at least what any readable interpretation denies, and allow rules never widen.

A new managed settings key, disableCommandPluginSources, stops plugins that come from a command source from being installed, updated or re-resolved. If it is unset it follows allowManagedHooksOnly, so an organization that already restricts hooks gets this too. Either key blocking produces a dedicated message naming both keys. Both fall back to blocking when the configured value fails validation. Only read from managed settings, so absent those, command sources stay allowed.

Settings pushed by an administrator can now switch off the co-authorship trailers Claude Code adds to commits. When the effective attribution setting resolves to disabled, commit trailers are forced off and the session URL line is suppressed too.

A marketplace entry that installs a plugin by running a command on your machine can now use mode: "link", where the directory the command produces is symlinked in place instead of copied. Link mode is refused on Windows. If the marketplace's command changed since you accepted it, the refusal now says specifically what changed, and the /plugin details pane shows the command and its mode.

claude doctor now flags unbracketed or non-canonical IPv6 addresses in allow and deny network domain entries, and credential injectHosts entries that can never match their destination because they are bracketed, carry a zone id, or are not canonically compressed. Each says to rewrite the entry as the bare, canonically-compressed address.

The help text for remote control now says -c/--continue reattaches to the session last recorded for the current directory or one of its git worktrees, and errors if nothing was recorded in roughly the last 4 hours. --session-id is likewise described as reattaching.

On Windows the self-hosted runner has no default working directory, so --base-dir (or the SELF_HOSTED_RUNNER_BASE_DIR environment variable) must now be supplied; the help text says so. A new launcher_hooks config section is also checked at load: every entry must name a known hook event and point at a .py or .sh filename matching a restricted pattern, and duplicate entries are rejected regardless of letter case.

/auto-mode-setup now opens on a confirmation step instead of a three-question flow. The "Question N of 3" counter is gone, replaced by a hint showing the left and right keys, the intro no longer claims it "takes a few minutes", the error for a bad argument was reworded, and context placeholders now say gathered "at setup" rather than "at Q3".