Claude Code v2.1.233

Before posting to an artifact comment thread, Claude Code re-reads it; if a Claude reply already stands after every "sent to Claude" request, the reply is refused and the draft discarded rather than repeating itself. A new acknowledge_duplicate: true parameter forces the post through, and the prompts now tell Claude to set it when posting a promised follow-up that genuinely adds something.

The bundled artifact templates (workshop skill, workshop-page, whiteboard, PR-review artifact and the artifact-components decisions block) now request capabilities through the newer viewer runtime when it offers one, and fall back to the older globals otherwise, so interactive elements arm reliably in both.

If Claude Code is watching a shared artifact for new comments and auto-replying to them, the "Background this session?" dialog now calls that out separately instead of folding it into the count of running tasks, and the confirm button reads "Background anyway (other tasks will be stopped)".

When a reply is attempted on an artifact comment thread that someone already answered, Claude Code no longer posts, and reports "reply not posted (thread already answered)".

If a query names a model Claude Code does not recognize, it now warns once per model, printing a line starting with [claude-code:unrecognized_model] followed by the model name and where the query came from.

When background events are delivered to Claude in batches, a batch cut short by size or count limits now says so in a system note, and each attachment carries a count of how many events are still waiting, so the model knows nothing was silently dropped.

Links to GitLab-style merge requests now display with an ! prefix and an MR label, and the URL is used exactly as given rather than rewritten through the configured pull-request URL template.

Paths under /net/<host>/..., the macOS autofs -hosts mounts, are now recognised everywhere UNC network paths already were. File-read, write and edit previews, notebook reads, file opening and sed target checks all skip content previews for them, and attaching such a file is refused with a message saying it is a /net autofs path.

Rows linking to a GitLab merge request are now recognised and labelled "mr" instead of "pr", and merge request numbers are parsed out of URLs and free text. Previously only GitHub /pull/ links were matched anywhere in these views.

Pasting a GitLab merge request URL now resolves to a number the same way a GitHub pull request URL does, and the row is labelled per provider.

When a session started with --watch-artifact pulls an artifact with no user prompt behind it, having the artifact tool enabled is no longer enough on its own: matching deny or ask permission rules for that tool now block the read. Previously this path returned allowed outright.

When Claude itself tears down a live frame or artifact monitor, the --watch-artifact and --watch-artifact-no-autoreact flags you passed stay on the stored command line. They are only stripped when the stop came from somewhere other than the model.

The instruction to post a brief reply and then resolve a review thread after acting on it was removed from the prompt. Claude will still reply, but will not mark threads resolved on its own.

Sheets and slides still describe themselves as commentable; documents no longer do. The doc description drops "and comment on" and now says the team can read and edit in place, and the separate text about a live editor with commenting wired up was removed.

The check for problems with your Claude Code installation now runs asynchronously at startup and returns immediately on a remote workspace, where the local install layout means nothing. Failures go to the error reporter rather than the screen.

When an MCP server repeatedly kills a held event-subscription stream, the client now counts reopens in a trailing window and, past a threshold, pauses re-listening for a jittered delay rather than reconnecting immediately. This is on by default (tengu_mcp_listen_reopen_park, fallback true).

Path-restricted Bash permission checks stopped extracting sort's -o/--output= target and stopped running a separate write-permission deny pass for sort and uniq. Both now use the generic positional-file handling and default to read access.

Paths beginning \??\ (the NT object manager namespace, and spellings that normalise to it) are now treated as suspicious. They trigger the same manual-approval ask as other odd Windows path forms, are rejected by the network-path check, and are caught during general path normalization, which previously only recognised the \\?\ device form.

A markdown file in a project's agent directory no longer produces "No frontmatter block found" or "No description in frontmatter" warnings unless its frontmatter actually declares a name. Files without one are reference documents the runtime skips anyway.

When the usage-limit checkpoint flow prefills your input with continue, typing a slash now removes that prefill so the slash command runs as typed instead of being appended to it.

The "Background this session?" confirmation now mentions artifact comment monitors that keep auto-replying from this terminal, alongside running tasks. When only monitors are running and no tasks are, the confirm button text changes to match.

Validation now refuses to follow symlinks and reports what it skipped, so a passing validation no longer implies the real target was checked. Install behaviour is unchanged and still dereferences them.

On Windows, the check that spots risky paths in commands now unwraps --flag=value arguments and re-checks the value, and flags NT object paths containing a /??/ segment.

The built-in skill that explains Claude Code's own configuration now lists the claude plugin subcommands available in the session and whether plugin eval is enabled.

The plugin eval CLI checks it can actually authenticate before running any cases, so a run fails fast with an explanation instead of partway through. It engages only for first-party auth in env-quad mode with none of ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN or ANTHROPIC_UNIX_SOCKET set.

Pressing left arrow to send work to the background no longer lists artifact comment monitors among the things that will be stopped. They are counted separately and shown as a line saying they keep auto-replying from this terminal.

Case names and per-case error lines printed by the plugin eval CLI now have control and format characters, plus line and paragraph separators, replaced with a space, so a crafted case name cannot inject escape sequences into your terminal. The "case files failed to load" tally is also suppressed when a JSON report was written.

Text you cut in one fleet view input can be yanked into another. The fleet view now creates its own kill ring and hands it to every input it renders, instead of each input falling back to the process-wide default.

The MCP tool-list refresh tool joined the set of tools withheld from subagents. A subagent that calls it gets the standard refusal telling it to finish with the tools it has.

Validation of plugins and projects now applies the same safety rules the loader does. Component directories and hooks.json are read without following symlinks and are size-capped, and anything refused becomes a warning telling you to validate the real path separately.

When a session creates its result branch, it now tries git switch -q -C first and falls back to checkout -B only if that fails, logging a retry line. Both attempts run under a timeout and honour cancellation, killing the git process and continuing on the current HEAD rather than hanging.

Agents in a teammate conversation are now told to report progress through their task tools if they have any, and otherwise in plain prose, instead of being told to use TaskUpdate for status.

When a directory sync skips more than 1000 files, entries skipped as sensitive, unreadable due to permissions, or with unreadable ignore rules are now kept in full instead of competing for space in the capped report.

The proxy-writing guidance bundled with the gateway docs still tells you to log upstream errors and return a generic message preserving error.type, but now makes an exception: if a 400 or 413 arrives in Anthropic's own error envelope, relay its error.message, because client-side recovery such as auto-compact keys on that text.

Stopping auto-replies for a session now tells you that a watch this session was carrying is ended or stays disarmed for anything continuing from it, not just that a new session re-arms on publish.

File read, file write and attachment handling previously treated only UNC paths (\\server\share or //server/share) as network paths. They now share one check that also recognises automounter paths of the form /net/<host>/..., and the attachment error text says so.

Publishing an eval report now prints Publishing report to claude.ai (private to you) before it happens. Auto-publish is additionally suppressed when the process is an eval interview subprocess, so nested runs do not each publish their own report.

Upstream 400 and 413 responses that carry a recorded message are now always replaced with a sanitized body and copied headers. Previously this rewrite only happened once a capability class had been resolved, so some responses passed through unsanitized.

Submitting a prompt now dismisses the leftover session-resume and cost-threshold dialogs, and the idle notification no longer fires while any dialog is still open.

The walk from your working directory up to your home directory looking for .claude subdirectories (agents, commands and the rest) now uses async filesystem calls instead of synchronous ones, so cold discovery does not stall the event loop.

A skill, command or agent file whose YAML frontmatter fails to parse now logs an error naming the problem, where previously the failure was discarded and the file was loaded as if it had no frontmatter at all.

The startup tip suggesting /install-github-app is now suppressed when the detected remote host is GitLab or Bitbucket, on top of the existing check on how often the GitHub Actions setup has been run.

The relaunch path no longer waits on a 1000 ms pre-cleanup drain before shutting down; it goes straight to the 2000 ms cleanup step and then the analytics flush.

Path canonicalisation and the network-path check previously matched only the \\?\ and \\.\ device prefixes. They now also match the \??\ object-manager form, including after Windows normalisation of paths containing ??, so those paths skip canonicalisation and are treated as device paths.

When a background agent denies a tool because it cannot ask you, the model now sees a plain "Permission to use X has been denied". The older wording about don't-ask mode is kept for that mode only, so the two cases no longer read the same.

When a component's YAML frontmatter fails to parse, the validator tells you the runtime consequence for that specific component type rather than a generic parse error.

The $5 spend warning and the prompt shown when returning to a resumed session are now regular dialogs rather than one-off screen state, so they queue with everything else instead of appearing on top of in-flight work.

Validation now warns when a marketplace file is a symlink or sits behind one, and validates each entry's plugin.json completely rather than only reading it to cross-check the version.

When enterprise policy blocks a github: shorthand source, the suggestion now names internal git hosts generally, listing GitHub Enterprise alongside GitLab Self-Managed and Dedicated, with a matching example URL.

If the very first run in an eval suite is rejected for bad credentials, the suite halts immediately rather than working through every remaining case and failing each one the same way.

The plugin manifest path check, which already rejected entries containing .. or absolute POSIX paths, now also rejects anything beginning with a drive letter such as C:\.

The spending-threshold acknowledgement no longer competes in the startup screen queue; it opens as an ordinary dialog and is guarded against opening twice. Acknowledging it still records tengu_cost_threshold_acknowledged.

On Windows, the check that spots network and device paths in Bash command arguments now strips --flag= and -f= prefixes repeatedly and re-checks what is left, and recognises \??\ NT object-manager paths. Off entirely on other platforms.

Directory walks that used synchronous file stats now use their promise-based equivalents, and the settings loader awaits its source list before reading settings in parallel. Same results, less blocking of the event loop while Claude Code starts.

The summary of running background monitors now says "1 Artifact comment monitor" or "Artifact comment monitors" when every monitor in the group is one, instead of the generic "1 monitor" / "N monitors".

The failure text shown for an eval case, taken from the heaviest failing grader or the run error, now has control characters and line and paragraph separators replaced with spaces so it cannot break report layout.

The internal request wrapper now passes a caller-supplied redirect limit through to the underlying HTTP client, alongside the content-length and body-length limits it already forwarded.

The server-sent-events reader used to cancel mid-stream once the connection was closing, discarding events it had already read. Both of those bail-outs are gone, so those events are now parsed and dispatched.

In print and SDK sessions, a tool call whose permission request was left parked is now closed out in the transcript with an error result carrying the standard rejection text, instead of sitting there unanswered. The session is marked idle afterwards, and failures to write the result are logged at warn level.

Paths of the form \??\..., including ones that only take that shape after Windows normalization, now count as network paths everywhere the check is made. They are blocked for @-mention attachments and Chrome file uploads regardless of which network directories the session trusts, and deep-link working directories using them are rejected.