Claude Code v2.1.232

New machinery commits your working tree, tracked and untracked files, to a Claude-owned git ref before a usage limit ends the session, plus a RESUME.md note listing the current TodoWrite plan and the claude --resume <id> command to pick it back up. The near-limit call site is behind the remote-config flag tengu_vellum_anchor, whose built-in fallback is off, and the commit additionally requires a policy capability.

Typing @name or @"name with spaces" in a prompt now offers completions and resolves to a running agent, a local session, a cloud session or a bridge session. An optional [ref] suffix disambiguates when several candidates share a name.

CLAUDE_CODE_HARBOR_KITE_CLOUD turns on cloud peer access. It only applies on top of first-party authentication and the allow_remote_sessions entitlement; without the variable the feature falls back to a server-side flag that is off by default. Setting it in .claude/settings.json or settings.local.json is ignored with a warning, since it is registered as blocked at project scope.

Typed prompts are scanned for @-mentions matching other live Claude sessions, found via local sockets, cloud sessions, bridge sessions and a team file. A match tells Claude to message that session using its exact "name [ref]" token; when several sessions share a name, Claude is told to ask you which you meant first. Off by default: the cross-session messaging feature flag tengu_harbor_kite defaults to false, CLAUDE_CODE_HARBOR_KITE forces it on, and Windows additionally requires tengu_harbor_kite_win.

A new built-in agent named web-fetch can now handle all page fetching. When it is active, the main loop loses the direct WebFetch tool and pages must go through the agent, which reads the page and reports a summary instead of raw text. Task calls to it show as "Fetch" in the UI. It is off unless CLAUDE_CODE_WEB_FETCH_AGENT is set or the tengu_clever_orbit server gate turns it on, and it also needs the allow_web_fetch entitlement.

Claude Code can now list the cloud sessions on your account and treat them as destinations for cross-session messages. It needs first-party login, the allow_remote_sessions capability on your account and an organization ID, plus either the CLAUDE_CODE_HARBOR_KITE_CLOUD environment variable or the tengu_harbor_kite_cloud remote flag, which is off in this build unless your server config turns it on.

The advisor list no longer shows models as greyed-out entries marked temporarily unavailable; it now shows only models you can pick, your current custom value, and No advisor. Choosing a Fable 5 advisor that needs credits now tells you it bills to usage credits and to run /model fable to review and enable it first.

Notification hook matchers can now target elicitation_url_dialog, worker_permission_prompt, push_notification, computer_use_enter and computer_use_exit, in addition to the existing types including elicitation_complete and elicitation_response.

The env block in settings.json may now set OTEL_SERVICE_NAME, OTEL_TRACES_EXPORT_INTERVAL and CLAUDE_CODE_FORK_SUBAGENT, which previously only took effect from the shell. The first names your service in OpenTelemetry output and the third turns forked subagents off.

Claude Code gains a proactivity level as real session state: tool contexts can read it, permission-mode decisions can record that the level decided them, there is a new system reminder kind named "proactivity" alongside attention budget and auto mode, and a keybinding action chat:cycleProactivity cycles it. The picker is behind a per-session latch that starts false and is only raised by code that nothing in normal startup calls, so it is off out of the box.

The artifact tool contains a complete path for live collaborative documents: an optional live_doc field added to its schema when the live-doc gate is open, extra tool prompt text, refusals for combining live_doc with url, force, files, pr_review or workshop, and calls to start and stop the collaboration when an artifact is watched, unwatched or published. The module all of this depends on is set to null in this build and never assigned, so none of it can execute.

Session state gains a proactivity level, initialised to default, and it is passed into tool-use contexts, subagent relaunch payloads and permission-mode resolution. A keybinding action for cycling proactivity exists but is filtered out of the generated keybindings documentation, and the switch that would show the selector defaults to false with nothing in this build setting it, so the UI is unreachable here.

Groundwork exists for running --cloud without an interactive terminal: a headless-cloud flag computed during argument checking exempts the invocation from the "requires an interactive terminal" refusal. It needs the tengu_violin_wood gate (off by default) and an eligibility check that returns false unconditionally in this build, so nothing can reach it here.

The artifact tool carries a full set of branches for a live-document mode: an extra live_doc schema field, its own summary and description text, refusal messages, a consent clause appended to the publish prompt, classifier tokens, and collaboration arming. All of it is reached through an optional module reference that is initialised to null and never assigned anywhere in this build, so none of these paths can run.

If Fable 5 is picked as the advisor model but your account has not set up usage credits, the failure message now points you at /model fable to review and enable it, instead of only saying the model cannot be used as an advisor.

/code-review used to be able to hand itself off to a scripted background pipeline instead of reviewing inline. That branch is gone, together with its scope, find, verify, sweep and synthesize stages, their schemas and effort levels, and the instructions about waiting for a completion notification. Reviews now always run inline, and the inline multi-agent review prompt is unchanged.

The review prompt no longer instructs the model to write findings to an HTML file, publish it as an artifact, and close the page with the line "Paste this URL back into Claude Code to keep iterating on these findings." Findings are still returned as JSON.

The advisor section no longer carves out one model as temporarily unavailable as an advisor, and defers to the advisor tool's executor-to-advisor pairing table instead.

The safety monitor gained a Third-Party Attack rule covering actions against outside organizations' real systems that no exercise designates as a target, including reading their non-public data even as a plain read. Its Chrome browser tool definition now also matches the mcp__remote-devices__ spellings used when a remote session drives your desktop browser over the device bridge.

The prompt box can fetch the list of other Claude sessions in the background and offer their names as @-mention completions, re-running the completion when the list arrives and keeping your selection if the rows have not changed. Enabled by CLAUDE_CODE_HARBOR_KITE, otherwise by the tengu_harbor_kite remote flag, whose in-source fallback is false; on Windows tengu_harbor_kite_win must also be on, and its fallback is false too.

A new settings row labelled "Messages from your other sessions" offers default, accept, hold and refuse. It is hidden in this build: visibility comes from a gate that is on when CLAUDE_CODE_HARBOR_KITE is set, otherwise reads tengu_harbor_kite with a fallback of false, and on Windows stays off unless tengu_harbor_kite_win is on. One code path that builds the config screen hardcodes the row to hidden regardless.

A new handler lets an IDE tell Claude Code that the prompt suggesting auto as your default permission mode was shown or answered. Accepting writes permissions: { defaultMode: "auto" } into your user settings and marks the prompt as seen. Both events now record which surface they came from, set to ide. Showing the prompt at all requires the tengu_maple_pier flag, which is off by default in this build.

A skill called "artifact-components" ships a catalog for embedding the reusable decision component into any HTML artifact: pinned theme and decisions scripts, a stylesheet, a design-token block and a markup skeleton. It is gated behind the same enablement check as the existing artifact workshop skill, and what that check tests is not visible in the build.

Instead of calling the WebFetch tool directly, Claude Code can hand fetches to a dedicated built-in agent. It is off unless CLAUDE_CODE_WEB_FETCH_AGENT is set or the tengu_clever_orbit server flag turns it on, and it additionally needs the allow_web_fetch capability, a non-coordinator session, CLAUDE_CODE_SIMPLE unset, and a subagent depth below the limit. The server flag defaults to off.

Fetch tasks run by the new web-fetch agent can write binary content such as a PDF to a local directory and append a note to the agent's report listing the saved paths, warning that any other path in the report came from page text rather than the harness. Gated behind the web-fetch agent gate tengu_clever_orbit or the CLAUDE_CODE_WEB_FETCH_AGENT environment variable, and only for built-in agents of type web-fetch.

The bash permission evaluator now carries a diagnostics object through parsing, holding the parsed command structure and flagging tooComplexByteExactAllow when a command too complex to analyse was permitted only by an exact character-for-character match against a rule. Later checks read that flag back.

When Claude Code writes fetched web content, saved artifact HTML, or persisted binary tool output to disk, the file path and its directory are now recorded in app state rather than being written and forgotten.

Session transcripts can now be addressed through Claude Code's managed storage layer, keyed by project, date and log name, and /debug reads its log that way when that storage layer is available.

Finding skills, listing their folders and reading each SKILL.md, now goes through the managed storage layer when one is configured, and falls back to reading the directory from disk when it is not.

The gateway validation above is backed by a newly inlined package carrying the full Claude Desktop managed-configuration schema (inference providers, MCP server policy, workspace and egress restrictions, bootstrap config, OTLP settings, plugin marketplaces), a per-provider model-ID sanity check, and a Zod 4.4.3 runtime with its full locale set.

Tool name and result rendering now receive the set of active agents, so a tool's displayed name and its background colour can depend on what is running in the session.

Claude Code will no longer fall back to auto mode if either permissions.disableAutoMode or the top-level disableAutoMode setting is set to "disable". The fallback also still requires the auto-mode circuit breaker to be inactive and remote config to allow auto mode, so setting neither key leaves behaviour as before.

The check for whether fork subagents are enabled now evaluates the hard disable and CLAUDE_CODE_FORK_SUBAGENT=false before anything else, and caches the result on the session config instead of a module-level variable. Setting the variable to true reports the source as the environment; otherwise a rollout check decides.

Subagent forking no longer waits on a staged rollout flag. Ordinary interactive sessions now get it, and the only way to turn it off is setting the environment variable CLAUDE_CODE_FORK_SUBAGENT to false. It stays off in non-interactive sessions and when coordinator mode is active.

Every artifact request (list, read, comments, delete, publish) now checks for a claude.ai OAuth token instead of accepting any authenticated session. Setups signed in by API key or other means get Not authenticated — run /login (no claude.ai login) immediately rather than a failed network call.

Delegation guidance now says subagents run in the background, that a completion notification will arrive on its own, and that Claude must not fabricate or predict results. If you ask before the notification lands, it should say the agent is still running.

MCP connect success and failure events now record which negotiation mode was used and whether the connection had to fall back after probing. In automatic negotiation mode, a request timeout during the Anthropic-side probe is now treated as a fallback case instead of a hard connection failure.

When auto-negotiating an MCP server's protocol version, a discovery probe that times out is now detected and the connection retried against the pinned legacy protocol within the remaining time budget, instead of the connect failing outright.

Bash permission checks now treat a file named by an output flag as something being written, not read. sort -o out.txt, sort -T dir, and the -t target of cp and mv go through write permission first, and a deny stops the whole command.

If a model refusal already moved you to a fallback model, a second refusal now updates only the fallback target instead of replacing the whole record. The originally recorded model survives, so coming back off the fallback returns you to the model you actually started with.

Subagent system prompts are now built with the agent's saved memory read in advance and handed to the prompt builder, so an agent sees what it recorded previously without a separate lookup. This only happens when auto-memory is on and a stored memory file exists; setting CLAUDE_CODE_DISABLE_AUTO_MEMORY turns it off and prompts are built exactly as before.

Deciding whether you have already accepted the trust prompt for a directory used to search every parent folder up to the filesystem root, so trusting something like your home directory silently trusted everything beneath it. The search is now bounded to the enclosing repository root and returns "not trusted" as soon as it would step above it.

WebFetch now rejects a redirect that stays on the same host but moves off the documentation path that made the original URL trusted, closing a way for a trusted docs entry to be used to reach unrelated pages on that host.

Messages arriving over the remote bridge may now carry an activity observation, for things like an edit or a reaction on the linked conversation. The message is wrapped with a preamble saying activity was observed, plus a guard telling the model this was not typed by you, is never an approval, and must not be re-processed as a fresh request.

Prompt expansion gained a stage that resolves an @-mention to a peer session rather than a file. It runs only for prompts you typed yourself and only for names not already claimed by a file or directory mention, marking each result as resolved or as needing you to pick from candidates. It is off in this build.

Publishing can now take an option that creates the destination path. It cannot be combined with a slug, force, a base version or a file list, forces the direct upload route, adds an extra capability and changes the wording of the retry advice on a failed fetch of the latest version.

The settings view can now show a row for a cross-session inbox, controlled by a new crossSessionInboxRowVisible prop. In the main REPL it is on when CLAUDE_CODE_HARBOR_KITE is set, otherwise a Windows sub-gate, otherwise the server flag tengu_harbor_kite, which defaults to off. A second place that builds the settings view hardcodes it to off, so without a server value the row stays hidden.

The artifact tool gained handling for live documents: its own permission description and summary, a classification marker, a refusal when a URL is supplied instead, and a creation path sent on publish. Every one of these reaches for the live-doc module optionally, so whether that module is present in this build is not visible from the code itself.

The rate-limit checkpoint commit checks a new permission called allow_local_checkpoint_commit. It is on the deny list for both the "hipaa" and "zdr" compliance modes, so on those deployments the checkpoint returns skip reason policy and nothing is written to the repository.

When Claude is called into an artifact comment thread it can post a one-sentence acknowledgement first and follow with the real reply. Off unless enabled: the in-source fallback for tengu_gorse_pylon is false and the real value comes from remote config, with CLAUDE_CODE_ARTIFACT_COMMENT_FAST_ACK as an environment override.

A new subagent prompt reads exactly one artifact comment thread, plus the rendered page data when needed, and writes a short brief for a separate composer that does the actual replying. Comment text is treated as reader feedback, never as instructions to follow.

Subagent launch records now carry an isBuiltIn flag alongside the existing fork, worktree path and working directory fields, so built-in agents such as the new web-fetch agent can be told apart from ones you defined.

Both the default app state and the REPL startup now begin with an empty projects identity record holding an account key, a list of the session's own message ids and a wire account id, where the previous build had an undefined remote project field.

Starting with --session-id alongside --continue or --resume used to require --fork-session. That combination is now also accepted when an SDK URL is supplied. The error text is otherwise unchanged.

Running /context now produces machine-readable numbers next to the rendered table, and SDK consumers receive them on the assistant message as context_usage. Fields are model, total_tokens, raw_max_tokens, percentage, categories, and an over_limit block containing tokens_over.

Admin policy sources can now put a defaultSettings payload on each per-OS entry of policyHelpers (or under a top-level default key). If no helper is configured for the platform, or the helper fails at startup or on a refresh, that payload is applied with no process spawned instead of the previous retain-or-fail behaviour.

The two forms of /auto-mode-setup now have separate availability. The interactive form still requires the envOnboarding field of the tengu_auto_mode_config remote setting to be on. The non-interactive form now only needs a resolved auto-mode model and CLAUDE_CODE_REMOTE to be unset. Previously both shared the gated check.

Remote-controlled sessions now attach a per-turn attribution key to API request metadata as tk, alongside device_id, session_id and parent_session_id. Because of that, tk has been added to the list of metadata names you cannot set yourself: anything you put under that name in CLAUDE_CODE_EXTRA_METADATA or CLAUDE_CODE_EXTRA_BODY is stripped before the request is sent.

The managed-settings policy helper, an admin-controlled hook that supplies settings at startup, now takes separate entries for macos, linux, windows and wsl plus an optional default entry that is a plain settings payload rather than a program to run. A helper that fails at startup or refresh falls back to that static payload without spawning anything.

The streaming message schema adds an optional context_usage field carrying a machine-readable twin of the /context breakdown, so tools consuming the stream no longer have to parse the markdown table.

The optimistic tool-search path now logs a single debug line naming its mode and the ENABLE_TOOL_SEARCH value, and refuses outright when ANTHROPIC_BASE_URL points at something other than a first-party Anthropic host.

The single "rebuilds in the last hour" counter is replaced by a budget of 3 recoveries per hour and 72 per 24 hours, and ten minutes of healthy heartbeats forgives the current window so a long-running session is not spent by an old rough patch.

When artifact publishing fails because the session is signed in the wrong way, the error now says artifacts need a claude.ai login, and if a Console API key was saved by an earlier /login it tells you to run /logout to clear it.

When a network proxy blocks artifact asset fetches, the error now names .frame.claudeusercontent.com (or .frame.staging.claudeusercontent.com on staging) and walks through adding it in environment settings, with org-level network rules mentioned as an alternative.

In the task list, f previously only brought in-process teammates and the leader to the foreground. It now also opens a running local agent task, meaning any agent other than your main session, and the footer shows the f foreground hint for those tasks.

The tasks and agents picker now follows the item you had selected across list refreshes instead of letting the cursor jump when entries are added or removed. Confirming on a running local agent brings it to the foreground and prints a "Viewing agent" message.

Generated HTML artifacts now carry a small inline script that highlights <pre><code> blocks in the browser, subject to a total character budget and a per-block size cap so large artifacts stay responsive.

Queue operations now go through one accessor, and the queue is built once with a callback that takes over anything enqueued before it existed. Commands queued during startup are preserved rather than dropped.

The sed-style edit path now reads the raw bytes of a file, detects its encoding and whether it uses Windows CRLF line endings from the first 4096 bytes, and writes back using both. Previously it assumed a single encoding lookup, which could rewrite line endings.

Secret redaction now recognises nine more GitLab credential types, and the two existing rules were rewritten to accept longer tokens. Previously only exactly-20-character glpat- and deploy tokens matched; the shared pattern now accepts 20 or more characters plus an optional 9-character checksum suffix, so current GitLab tokens are caught.

Sessions now carry a proactivityLevel setting, defaulting to "default", which is passed into relaunch, the auto-mode restart path and subagent spawning, and accepted by the permission-mode resolver. The resolver still returns no value for it, so nothing about Claude's behaviour changes on this build.

Five internal state containers gained a method for copying selected fields from a previous instance. Nothing in this build calls it, so no behaviour follows from it yet.

The artifact tool contains a full set of live-document collaboration branches, including optional kind and liveDocCollab inputs, consent and refusal messages, and a per-session stop observer. The module they all hang off is initialised to null in this build, so every one of those checks is false and none of it can run.

The artifact tool carries new live-document branches, including a liveDocCollab field on two response schemas and checks that force a permission prompt for live-doc inputs. Every one of them routes through a module reference whose only assignment in this build is null, so none of it runs.

Five internal per-session stores (conversation counters, MCP wiring, an emitted-date record, user presence, and connected clients) gained a method that copies one field from another instance, the shape of carrying a little state across a session identity change while the rest resets. Nothing in this build calls it.

The storage key scheme adds a session-log area addressed by project, year, month, day and a log name, with validation on both the key and its scope. Nothing in this build reads or writes it; it exists only in the key builder and the validators.

Two separate checks were folded into one resolver returning "none" when CLAUDE_AGENT_SDK_DISABLE_BUILTIN_AGENTS is set in a non-interactive session, "coordinator" in coordinator mode, and "default" otherwise. The env var behaves as before.

Managed and desktop gateway configuration now sets inferenceCredentialKind: "interactive" in place of inferenceGatewayAuthScheme: "sso". The old key still works but logs a deprecation warning and is rewritten to the new one, so existing managed settings keep working without edits.

policyHelpers, the top-level setting where an IT admin points Claude Code at a program that supplies managed settings, now also accepts a plain default settings payload and a per-OS defaultSettings payload used when no helper runs or the helper cannot be reached.

A remote control client can now send keep_session_on_exit (client-side option keepSessionOnExit) when it connects, and the session record is kept rather than archived when Remote Control is later disabled.

Setting CLAUDE_CODE_ENABLE_EXPERIMENTAL_ADVISOR_TOOL still skips the advisor rank requirement, but no longer skips the other per-model eligibility guards. Those guards previously sat after an early return that the env var triggered.

The check for whether artifacts are available dropped a secondary condition and is now the environment term or the tengu_cobalt_plinth gate, which is off by default. Direct upload, gated by tengu_cobalt_plinth_direct (on by default) and CLAUDE_CODE_ARTIFACT_DIRECT_UPLOAD, now also kicks in whenever a create path is supplied.

Renaming now has three outcomes: a normal rename, a yield where the requested name is already held by another live session on the same machine and a different name is assigned instead, and a supersede where a newer rename landed first.

The list of environment variables Claude Code recognises now covers OTLP compression and per-signal protocol and temporality settings, so telemetry exporters can be configured with the standard OpenTelemetry names.

Set CLAUDE_CODE_CLIENT_KEY_PASSPHRASE and Claude Code decrypts the client private key with it when checking that the key matches the configured certificate chain, so an encrypted key file no longer fails the pairing check.

A https://gitlab.com/... marketplace URL is now recognised as a git repository and cloned, instead of being treated as a plain URL download.

When another Claude Code on the same machine already has Remote Control for a conversation, you now get a message saying so and pointing at /remote-control to move it to the current terminal.

Pages built by the design canvas, whiteboard and artifact editor that can publish changes back to themselves now declare capabilities: {artifact: {}}; the older spelling self is still accepted. Declaring both with different configs is rejected.

The Background dialog list adds a Completed group, shown between local agents and dynamic workflows. Local agents that have finished but are still being held alive now count as stoppable, so the x stop hint appears for them too.

Trying to restart, or to switch renderer with /tui, while background work is running now points you at /tasks to stop that work instead of only telling you to wait for it.

Installing a plugin now refreshes its marketplace before showing you the catalog, so newly published plugins appear without a manual step. If the refresh fails you get a warning line above the plugin details and the cached catalog is used instead.

A background session's name now records a third origin, collision, alongside user-chosen and derived. Names given for this reason are treated like user-chosen ones when a session respawns, so the --name/-n flag is preserved rather than dropped, and the session list displays them differently.

Before binding the socket used for messaging between sessions, Claude Code now creates the parent directory and sets it to owner-only (0700), then removes any stale socket. If you passed --messaging-socket-path yourself and it fails, the error tells you what to do.

/list-agents and the send-message error paths now say outright when the cloud session list could not be retrieved, so a session missing from the list is not mistaken for a session that does not exist.

Settings with a fixed set of allowed values now get a picker instead of only on/off toggles and free text, opening with the current value selected and enter/esc hints in the footer.

The bug report command is now dispatched as immediate, so the dialog appears straight away rather than queueing behind the normal command flow.