Claude Code v2.1.234

When a claude.ai usage limit stops your session, Claude Code can now hold the session open, wait for the limit to reset, and resume the interrupted task by itself. It is controlled by a new autoContinueAtUsageLimit setting that defaults to on, is also offered as a choice in the /rate-limit-options dialog when the setting is off, and announces itself with notifications when it arms, fires, or gives up. A set of specific cancellation messages covers every way the wait can end, so you always know whether the task will restart on its own.

A CLAUDE_CODE_SLACK_TAG_TOKEN environment variable now counts as third-party authentication and is stripped from environments given to spawned commands. The status line gained a slack-tag segment, which suppresses the separator dot the way the bridge and pr segments do, and the available tool set is recomputed whenever the Slack tag connection flag changes.

The tool that publishes artifacts to claude.ai gained four actions for that artifact's file store: upload_asset sends a local file and returns a _blob/<id> URL the page can reference, list_assets enumerates them, read_asset saves one back to disk (default the working directory, named by its 32-character asset id) and delete_asset removes one permanently. Uploads cap at 20971520 bytes, or 2097152 for SVG. Set CLAUDE_CODE_ARTIFACT_ASSETS to turn the actions off; they are otherwise present.

Claude Code can pull skills down from the claude.ai account you are signed in to, and a new settings key switches that off. Set syncClaudeAiSkills to false in user or managed settings and nothing more is downloaded, previously synced skills in ~/.claude/skills/synced stop working and are moved to ~/.claude/skills/.trash at the next launch. Set it in .claude/settings.local.json or via --settings and the block covers only that workspace or invocation. Only false is honored.

The artifact feature no longer defaults to off. With no remote-config value present, artifacts are enabled when the account's auth source is unset, prosumer_oauth, or no_auth, and stay off for every other auth shape. Remote config can still turn it on or off in either direction.

The remote flag that could disable bypassPermissions mode, the asynchronous re-check that exited the process mid-session, and the "disabled by your organization policy" message are all removed. The only remaining route to disabling the mode is the disableBypassPermissionsMode setting.

v2.1.233 had a startup check that consulted a remote flag once per process and, if it fired, forced the session out of bypassPermissions back to the default mode and marked the mode unavailable. That check and its one-shot latch are removed. The disableBypassPermissionsMode admin setting still parses and still blocks the mode.

A new gate, tengu_jiggly_mochi, adds a shortcut that sends queued messages right away: while a turn is running in prompt mode, submitting interrupts the turn and flushes the queue. With it on, the input hint changes to "Press up to edit queued messages, Enter to send them immediately". Its in-source fallback is off, so whether it runs is decided by server configuration.

A new in-session nudge watches the conversation for signs of frustration and would suggest flagging an issue. It is registered on every build, but the code that would display anything is empty, so nothing is ever shown.

Session state and message records now carry the plumbing for connecting Claude Code to Slack tagging, including a connection flag, an environment variable for a token, and a per-message ownership marker. Every piece is wired through to storage and to the tool-selection path, but nothing in this build ever turns any of it on, and no tool or user-facing surface appears as a result.

A new inbound session_notice message would let one session inject a coordination notice into another as a turn element. Nothing can trigger it in this build: it needs the remote-session environment variable, the tengu_polished_lagoon flag (off unless the server says otherwise), and a helper compiled to always return false.

Before an approved upload is read, the path is re-resolved and opened refusing symlinks, then re-checked against the identity recorded at approval, so a file cannot be substituted after you approve it. Available only where asset actions are enabled by CLAUDE_CODE_ARTIFACT_ASSETS.

CLAUDE_CODE_PROJECT_DIR_NAME, used to derive the project directory name, and CLAUDE_CODE_ENVIRONMENT_KIND, whose observed values include "bridge" and "byoc", are now on the lists that decide which variables get passed to or scrubbed from child sessions.

The MCP server Claude Code exposes to other tools now checks incoming tool calls against the tool's own schema before dispatch and refuses a mismatch with "arguments failed schema validation" rather than passing raw input through, and it aborts work already running when a client cancels or the server shuts down. The same code now takes a transport kind, and passing "http" turns on a heavily restricted profile. Nothing in this build passes "http": the claude mcp serve command hands the server the stdio transport, so the restricted profile is reachable only by importing the module directly.

The permission context used when checking a tool call gained a flag that marks a poll-event or empty dispatch delivery. While it is set, the layers that would normally inject or replace the list of always-allowed commands leave the context untouched, so the allowlist cannot grow during that delivery.

The desktop app can hand the CLI a prompt built from a comment you left on an artifact, and the CLI now recognises that handoff, picks up the comment thread it refers to, and marks the prompt so its own comment watcher does not reply to the same comment a second time. This path is desktop-app only; other clients never see it.

A message injected between sessions can now carry an optional fromMode of "bypass" or "prompting", saying whether the sender was running tools without asking. A message from the same class can be delivered immediately; a cross-class or undeclared sender is held when the recipient runs tools without asking.

Artifacts can be watched so Claude replies to their comments automatically, and this build reworks both ends of that loop. Comments now carry a marker saying they were posted through the artifact's own interface, which keeps Claude from treating its own posts as new human input and gives those comments a distinct attribution label. Alongside it sits a resume_replies action for re-arming a watch you stopped, which is fully written but not reachable in this build.

The block that tells Claude your email address no longer just states it. It now instructs Claude never to send that address to an unrelated service, whether in a request header, a URL, or a payload, unless you explicitly ask. This applies whenever an email address is known, with no setting to turn it off.

Two remote-config lists can now switch off newer MCP behaviour for named servers: one disables protocol-era negotiation, so the server gets the legacy handshake, and one suppresses listening. Servers match on URL hostname, exact or suffix, with * matching everything. Both lists fall back to empty, so nothing is disabled unless a server value says so.

A new per-session narration facility hooks into each tool round for non-subagent sessions to produce running commentary. It is off unless CLAUDE_CODE_ENABLE_NARRATION is set, and the interval that paces it comes from a server config value that falls back to 0, meaning no narration when neither is provided.

After a successful gh pr create that is not a --dry-run, Claude Code can post the owner, repo, PR number and head branch to a new /worker/record-created-pr endpoint. This is gated on tengu_record_created_pr_to_ccr, which reads false without a server value, so nothing is sent in this build.

When a session is resumed and a permission request was parked without an answer, Claude Code can now drop that request, record why, and skip re-running the interrupted turn. All parked prompts left over from the session are cleared together rather than just one, anchored to the latest assistant message among them. The code is present in this build but does nothing unless the environment variable that gates it is set, so by default resume still re-runs the interrupted turn.

While the main loop is busy, Claude Code can run a background one-turn query with no tools available that produces a short status line saying what Claude is doing now and what it plans to do next, then draws it as a block below the spinner instead of the old single-suffix line. It is paced by a configured interval and is off unless explicitly enabled, so nothing changes for most users in this build.

Permission state now pulls rules matching the dangerous pattern out of the active always-allow list into a separate held list, with a path to put them back, so a session can carry those rules without them taking effect.

Inbound messages from another session used to be classified as peer traffic purely by origin kind. Messages marked as host-injected are now recognised as their own class and run through the coordinator acceptance and opt-out rules instead of the peer ones.

The rate-limit tracker now emits an event when a rejected request is observed, and a controller subscribes to it to re-arm or cancel an automatic resume after a quota block. None of the identifiers for this subsystem exist in the previous build.

Plan mode now applies auto-mode permission semantics whenever auto mode is available. The new boolean useAutoModeDuringPlan appears in /config under Permissions and defaults to true; setting it false in any settings source (policy, command-line flag, user or local settings) wins and turns it off.

Programmatic sessions (SDK and --output-format stream-json) now get a message whenever the permission mode changes: {type:"system", subtype:"status", status:null, permissionMode, uuid, session_id}. The same status is re-sent when a remote client reconnects or attaches, so a client that joined late still knows the current mode. Controlled by tengu_wobbly_pinwheel, which falls back to true, so it is on unless remote config turns it off.

Before relaunching, both commands check for state that cannot be reconstructed from a restart command line: permission rules that exist only for this session, ask rules with no command-line equivalent, added directories that cannot be spelled out, and a running auto-reply monitor for artifact comments. Instead of the old generic "busy" message, they name the specific blocker and tell you what to do about it. /tui saves your renderer preference but stays where it is; /update tells you to exit and start claude again yourself.

The three bundled artifact templates no longer commit each edited block as you type. Editing is local until you press the Save button or Ctrl/Cmd+S, which republishes the whole page. The old per-block commit machinery and its "Local only", "Editing…" and "Some edits local only" states are gone.

The three artifact skills now tell Claude to declare the publish capability on the first publish, which is what lets readers who have edit access save changes back into the page. Updates must re-read the published page first, republish with the capability field omitted rather than empty (an empty object clears the declaration and switches saving off), and never pass force, because a publish conflict means someone else saved.

When the API returns something that is not a message, the error now fingerprints the responder instead of failing bare, and suggests checking for a proxy or gateway intercepting the request. Two new structured log events, cli_api_error and cli_api_retry, carry the same detail. This is aimed at corporate gateways sitting in front of the API.

Permission changes coming from hooks, a permission-prompt tool or an updatedPermissions response now go through a separate session-level setter as well as the app-wide one. Contexts that intentionally do not share app state, such as background agents and some SDK hosts, pass a no-op for the app setter but still forward the session one, so a granted permission takes effect instead of vanishing.

When Claude Code asks an IDE or an MCP server to approve a tool call, the description it sends is now run through secret redaction, whitespace collapsing and middle-elision truncation instead of being forwarded as-is. The request also goes only to servers that finished registering their permission channel, rather than to every connected server that advertised support for one.

A command listed in sandbox.excludedCommands used to run outside the sandbox on the strength of that list alone. It now also requires that unsandboxed commands have not been disabled for the session, so once something turns them off the exclusion list no longer opens a hole.

If uploading your local working copy to the remote session fails, and the session can be sourced from GitHub instead, Claude Code now logs that and continues from GitHub without your uncommitted local changes rather than aborting with an upload error.

When a file changes underneath Claude mid-session, the note it receives no longer asserts that you made the change deliberately and already know about it. It now says to work from the current contents, to say something if the change looks wrong rather than quietly undoing it, and otherwise not to comment on it.

A subscriber called issue-flag ships with patterns for risky commands and for signs of user frustration, but its setup returns an empty handler, so it never fires in this build.

The table that sorts slash commands into menu groups gained an entry filing a command called "thrash" under actions, alongside teleport, stop and rewind. No such command is defined in this build, so nothing new appears.

The internal storage addressing scheme learned about terminal recording files, stored as .cast streams inside a session folder and named by an epoch-millisecond timestamp. New filesystem helpers reject reads of symlinked paths, non-regular files, hard-linked values and anything over the size cap, each with its own error.

A new internal component named wellbeing is registered and declares that it needs settings, notifications and a clock, but it does nothing at all in this build.

When Claude Code is running as a remote session, calls to claude.ai for publishing, comments and reads may now be sent through /v1/code/agent-proxy/frame on the gateway using the session's own token, instead of calling claude.ai directly with OAuth. If the relay refuses or errors, the request falls back to the direct call and that request family is skipped for a cool-off period.

The scheduler that decides when Claude scans and answers comments on an artifact was reworked so that repeated wakes are grouped together instead of each triggering a scan. Wakes can now be tagged as confirmations or re-entries and are coalesced within a settling window, timers carry extra padding, and the fast-acknowledge flag can be refreshed against a deadline before a decision is made. Alongside it sits a stand-down path that skips replying when every comment addressed to Claude was already answered in a visible turn, and neither the window override nor the stand-down is switched on by anything in this build.

Stopping auto-replies on an Artifact can now be made durable: a latched artifact short-circuits publishing and subscribing with the reason stop_latched until it is explicitly relatched, and a pending relatch approval is recorded against the tool call that asked. The matching "Auto-replies on Artifact: ... were resumed" notice exists but the resume path is hard-disabled in this build.

A restricted artifact mode is present in which the tool accepts only a plain publish. Any other explicit action, and any live-doc input, is rejected both when validating input and at call time with the error code stub_mode_publish_only.

The REPL tool can now hand a script to a dispatcher, return a receipt immediately and deliver the real result later as a background poll event. The gate is a build-time constant that is false here, so every call runs the synchronous path.

Session checkpoints now record how many times a self-scheduling loop has woken and what live Artifact watches were open, and each scheduled wake-up records when it is due, why, and whether it holds a keepalive budget. The loop feature itself is behind tengu_kairos_loop_dynamic, whose in-source fallback is false, so it is off absent a server value.

Dozens of places that save data now use the alternative storage backend only when the tengu_hover_rest flag is on, read once per process, and otherwise fall back to ordinary filesystem calls. Absent a server value the flag reads false, so this build writes to the filesystem as before. Files written through the new path get an explicit mode of 438 & ~process.umask(), or 384 for secrets.

When Claude Code runs underneath a supervising host, a new piece of state tracks whether that connection is live, set false on connect, close and stop and true once the host's capabilities arrive. Artifact auto-react is now treated as available only when both those capabilities and a live link are present. Outside a supervised session the check returns early and nothing changes.

The record a session leaves for its successor now allows scheduled wake-up entries to carry a due time, a reason and a keepalive marker, and the 256-item ceiling on what a handoff will accept now counts live Artifact watches alongside shells, scheduled entries, agents and workflows.

The startup path for Claude Code's MCP server now explicitly asks for the stdio transport and registers a hook that closes the server on shutdown. The builder accepts an alternative http kind that disables background tasks and unsandboxed commands before serving; no caller in this build requests it.

The machine-readable description of Claude Code's JSON output gained two blocks. One describes what a cloud-hosted session reports when it starts up; the other describes a notice composed by the server on behalf of another session.

PR-review artifacts are built from parts pinned to exact content hashes, and the hash for the "decisions" part changed, meaning that script was rewritten this release. A part that fails its check blocks publishing with an out-of-sync template error.

If CLAUDE_TRUSTED_DEVICE_TOKEN is set in the environment, the remote bridge no longer runs its untrusted-device retry and re-prompt.

When a /goal cannot be evaluated because background shells or agents are still running, Claude Code now injects a check-in message on an interval. It says either "Goal check-in: background work still running", listing the blocking shells and agents and telling Claude to check their progress, or "Goal check-in: background work no longer running". The default interval is 30 minutes; set CLAUDE_CODE_GOAL_CHECKIN_MINUTES to override it, or to 0 to switch check-ins off.

A single helper now answers whether workflows are disabled, covering the entitlement check, the enableWorkflows user setting being false, CLAUDE_CODE_WORKFLOWS set to false, and the remote tengu_workflows_enabled gate (fallback true). Workflow warm-up returns early when it says so.

Commands can now mark themselves as resolving immediately rather than on the next render pass. /help and /theme do so whenever the flicker-free alternate-screen renderer is active, /add-dir when it is active or when you passed an argument, and /config and /advisor when the tengu_immediate_model_command flag is on, which falls back to off.

The external helper that answers permission policy questions can now be a .ps1 file on Windows, not just an .exe. A .ps1 path containing [, ], a backtick, * or ? is rejected, because PowerShell would treat those as wildcard syntax and resolve the path to something else.

Two high-confidence detections were added, slack-workflow-token for xwfp- values and slack-webhook-url for hooks.slack.com service, workflow and trigger URLs. Log redaction also gained xapp-, xwfp-, a bot-token form allowing the dotted xoxb.xoxb- shape, and webhook URLs. Separately CLAUDE_CODE_SLACK_TAG_TOKEN is deleted from the environment handed to child processes.

The status pill shown when a Remote Control session is present is now a hyperlink with a hover state, and the URL it opens carries from=cli. Clicking it or activating it from the keyboard reports tengu_rc_pill_clicked with which of the two it was and the pill's label.

When one of the interactive slash commands throws, the error is reported back into the conversation as command stderr instead of the UI just clearing. Telemetry now separates a command you aborted from one that threw.

When a background agent run stops, its stop reason is now mapped to one of auth, billing, context limit or model unavailable, each with a user-facing label and error code, so a failed run says why it failed. A "credit balance too low" stop is reported as a billing problem.

Repeated polls for background events were accumulating system-reminder text in the conversation. Results whose tool id starts with poll_ are now skipped by the reminder-merging pass, as are text blocks that are themselves event-delivery reminders.

A response block missing fields it should have no longer throws. A text block whose text is not a string is dropped, and a thinking block missing its thinking text or signature gets empty strings substituted so the conversation continues.

Pressing up and down through prompt history now notices when another Claude Code session has appended entries, re-reads the file, and shifts the cursor and any in-progress edits by the number of new entries, instead of jumping to the wrong prompt.

Prompts and warnings tied to a specific model now look through aliases: opusplan and opusplan[1m] count as Opus, haiku counts as Sonnet. You get fewer confirmations and fewer misdirected limit warnings when running on an alias.

/update, /tui and the handoff to the desktop app now snapshot the conversation under a named handoff before restarting, so the transcript is carried across rather than picked up by chance. A restart that fails now says so inline instead of leaving the session in limbo.

Both prompts that generate automatic session titles were rewritten so a title is a short noun phrase of two to five words in sentence case, leading with the most specific identifier and written in the language of the session content. Request verbs like fix, add and investigate are banned at the front, and trailing abstract nouns like evaluation or investigation are dropped, so you get "Login button styling" where you used to get the old sentence-style "Fix login button on mobile".

Logging in again with the same account no longer discards a pending "wait for the usage limit to reset and continue" claim. The logout path that clears cached state now takes an option to preserve it, and the OAuth re-login path sets that option by comparing the incoming account and organization identifiers with the current ones.

The socket that carries your in-progress prompt text between Claude Code and an editor now destroys any connection that is no longer the active one rather than acting on data from it, and clears its in-use flag when the active connection closes. Stale connections could otherwise restore an old draft over your current one.

The component that builds and checks internal storage keys gained a recording kind, addressed by project, session id and a timestamp. Nothing in the build produces recordings, so what would create one is not settled here.

Internal one-shot queries such as summarisation, title generation and permission helpers now include a proactivity level in their options. The helper that supplies it has an empty body, so the value is undefined at every call site.

The standalone holder for the proactivity selector gate was deleted in favour of a value stored on host state that can be re-sampled with a change notification and can own a host-side subscription. A proactivity field also now appears in the context the main loop assembles, but the function that would build it returns nothing, so that field is always undefined.

Session state gained a proactivity-level change notification, permission-mode resolution now also returns a proactivity value and whether the mode was supplied on invocation, relaunch passes that value along, and the system init message accepts a proactivity state. The function that turns that state into the emitted field is empty and returns undefined, so nothing is reported.

Setting CLAUDE_CODE_EVAL_ARTIFACT_STUB_DIR makes artifact publishing write to that directory rather than contacting the artifact service, producing an index.html, a files/ folder for supporting files and a manifest.json, and returning a synthetic URL with version "1".

The admin-controlled policyHelpers config, which computes managed settings at startup, now accepts a script plus interpreter pair as an alternative to path. The script is handed to the interpreter over stdin and never written to disk. It is capped at 65536 characters, must be NUL-free valid UTF-8, and must be ASCII-only on Windows. The interpreter is fixed per operating system: sh on macOS, Linux and WSL, pwsh on Windows.

A grader of type llm pointed at a PNG, JPEG, GIF or WebP file now shows that file to the judging model as an image, so rendered slides, charts and screenshots can be graded on what they look like. A regex grader over an image always fails and says to use an llm grader instead; over other binary files it still matches ASCII sequences.

A slash command's sensitivity can now be a function of the text typed after it, not just a fixed yes or no, and the same check is used by both the transcript and the input handler. The "isn't available over Remote Control" rejection now echoes the command as /name *** when it is sensitive instead of repeating what you typed. No command shipped in this build uses the function form.

Claude Code keeps each project's history and sessions in a folder under projects in its config directory, named after the project path. You can now name that folder yourself with CLAUDE_CODE_PROJECT_DIR_NAME, which only applies when CLAUDE_CONFIG_DIR is also set.

Startup now recognises a plugin eval invocation, alongside the non-REPL subcommands and mcp serve, and skips capturing early stdin so the input reaches the eval run instead. Unconditional in the CLI entry path.

Saying yes to the fullscreen upsell now sets tui to fullscreen and hands over to the new renderer in place, instead of routing through a relaunch.

Clearing a selection in the scroll view is now the keybinding action selection:clear in the "Scroll" context, so you can rebind it. When nothing is selected the handler declines the key so it falls through to whatever else wants it.

The skill that helps you write plugin evals now states a hard rule: a grader that implies a side effect only passes if the case allows the tool that produces it. A grader checking a file exists needs Write or Edit, a grader checking a tool was used needs that tool, and a task that runs a scan, build or test needs Bash. Authors are told to size timeout_seconds and max_turns to the actual task rather than copying the template.

The offline reference bundled for claude plugin eval now says image focus files (PNG, JPEG, GIF, WebP) are shown to the LLM judge as images, which it previously listed as upcoming. It also documents exit code 2 for hitting the cost ceiling or an auth failure, and 143 for a terminated run.

Commands that declare themselves sensitive, including invocations whose arguments are hidden pastes, are now skipped when prompt history is written rather than stored. History entries also get strictly increasing timestamps, and undo is only armed when the caller asked for it. CLAUDE_CODE_SKIP_PROMPT_HISTORY still turns history writing off entirely.

The JSON handed to a custom statusline script documents a new kind: "mr" field on the pr object, present when the current branch's change is a GitLab merge request and absent for GitHub pull requests. The worked jq example was rewritten to print either MR !N or PR #N.

TodoWrite, TaskCreate, TaskGet, TaskUpdate and TaskList calls are now folded down in the transcript so long task bookkeeping stops crowding out the conversation. Previously only one tool collapsed, and only in one display mode.

A plain-text user message is now run through the markdown renderer in a new prompt mode instead of being printed raw, so lists, headings and code blocks in what you typed show up formatted. It applies in both the brief and the full transcript layouts.

Starting with --watch-artifact from a remote session errors immediately instead of trying to subscribe, and the message points you at running it locally. The explanation given to the model was rewritten to note that publishing and reading comments still work.

Two environment variables fence what an eval suite can do to the machine running it, both off by default. A suite asking to publish artifacts only does so if the operator passes the flag or sets CLAUDE_CODE_EVAL_ALLOW_ARTIFACT_PUBLISH, and a suite's feature-flag overrides are filtered against an allowlist in CLAUDE_CODE_EVAL_ALLOW_FLAG_OVERRIDES, with anything unlisted dropped and reported on the console.

While CLAUDE_CODE_EVAL_ARTIFACT_STUB_DIR is set, published artifacts resolve to local stub URLs of the form eval-stub://artifact/<slug> and the /artifacts browse command is hidden, since there is no remote gallery to browse. The plugin eval CLI sets the variable for the sessions it spawns.

The plugin eval runner now traps SIGTERM as well as SIGINT, exiting 143 and 130 respectively, and records the run outcome as "terminated", "interrupted" or "signal_killed". Report titles now name the suite's plugins and versions instead of the fixed heading "Eval suite".