Source Intelligence

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

All of v2.1.234 Home All releases olderv2.1.233 v2.1.235newer
Claude Code v2.1.234

Saved artifact HTML is sanitized and refused if it will not round-trip

Not switched on
Useful2 Signal3
Artifacts

Artifact saves get sanitized and refused if the content cannot be published cleanly, in a disabled skill.

HTML sanitizing and a refusal message ship in the artifact editing skill, whose registration check is false.

What

Because a save now republishes whole-page HTML that other viewers will run, the artifact editing skill sanitizes it first and refuses saves it cannot publish cleanly, with the message "Couldn't save. Part of this content can't be published." Part of the same skill, whose registration check is false in this build.

Details
  • A tag denylist covers SCRIPT, IFRAME, FORM, INPUT, TEMPLATE, FOREIGNOBJECT, MATH, PORTAL and more.
  • Stripped attributes include every on* handler, srcdoc, autofocus, name, and the top-layer set popover, popovertarget, interestfor, commandfor, command.
  • URL attributes are scheme-checked, with per-entry checks inside srcset and ping; data: URIs are allowed only for images; style attributes are rejected if they contain url(, expression( or a backslash.
  • Comments that could terminate the document early or that read as the runtime marker are removed.
  • The save must also survive the browser's own re-parse unchanged: outside the article it must match the served shell node for node, or the save is refused.
Evidence

Couldn\u2019t save. Part of this content can\u2019t be published.

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.234 →