Claude Code v2.1.235

The document artifact template now stamps every commentable block (headings, paragraphs, list items, table cells) with a short stable id, so comments stay attached to the block they were left on when the document is edited.

Before reading a plugin's manifest, Claude Code now checks that the plugin directory is actually owned by you and not writable by anyone else. Trees that fail the check are refused, so a plugin folder someone else can edit no longer gets consulted.

When Claude finishes planning and asks to proceed, the plan text is now checked against a 200,000-character cap and a test for elided content first. A plan that fails either check offers no approval option at all: every "Yes" row is removed and only "No, keep planning" remains, with an explanation in the dialog. Unconditional in this build.

When you hit the context limit and auto-compact is off, the banner now says "auto-compact is off" and points at /config to turn it on. The hint only appears when you turned it off yourself: the autoCompactEnabled setting (default true) resolving to false in user settings, or in legacy global config while user settings are in play.

When packaging your work for a cloud session, being behind the remote is now distinguished from having otherwise diverged from it, using a merge-base check, and the caller can start from your local commit in that case instead of refusing. When ancestry cannot be determined it warns instead.

A policy helper delivered through remote managed settings must now be a real local executable path. UNC paths, network automounts (/net, /Network/Servers) and kernel magic links (/proc, /dev/fd) are rejected, and inline scripts are refused outright.

When starting a container-backed session from a repo whose checkout is behind the remote, a pinned session now seeds from the remote ref using the tree it probed; otherwise it reports as not armed through the same builder used for uncommitted tracked changes and other diverged states.

Branch and worktree comparisons now have a distinct "is behind" result naming the remote, with an explanation that work will start from this checkout's commit rather than the remote tip, as of the last fetch. A separate new message caps how many untracked files can be seeded into a remote session.

Declining the prompt that offers to set up an environment for auto mode now increments a stored denials counter, capped at 5, and the fuller onboarding flow is only offered once those denials have accrued. Choosing later or dismissing records the dismissal instead.

Resuming automatic replies on an artifact now distinguishes two situations that previously fell together. A live watch connection that began before the watch was stopped and is still winding down cannot be attached to by a resume, and replies being held by the artifact's own watch stop rather than by a separate stop on the replies are refused with a message that there is no separate auto-reply stop to resume and that only an approved re-watch releases them.

The refusal shown when an artifact asset cannot be read now states exactly where such reads work: a local session, or an Anthropic-hosted cloud session with its gateway relay enabled. Reads of public assets are no longer subject to the same access gate as private ones.

Trying to arm auto-replies while an earlier connection is still closing now says so plainly: "auto-replies not resumed (an earlier connection is still winding down; the stop stays)", instead of a vague skip.

When asset uploads, listings or deletes cannot run, the message now names the supported setups (a local session, or an Anthropic-hosted cloud session with its gateway relay enabled) and says retrying will not help, instead of only reporting a missing route.

MCP elicitation text, MCP and WebSocket tool descriptors, Bash commands, skill names and descriptions, notebook cell ids and artifact labels now go through display sanitizers with a length cap, and missing MCP server or tool names show a placeholder such as "(unnamed server)".

Omitting subagent_type on the Task tool used to fall through to a default agent. It is now rejected, unless your agent set leaves only one possibility, with an error naming the available agents, or "none" when there are none.

When an MCP server asks to open a URL, the confirmation dialog now renders it through a preview that reports whether the full URL can be displayed. If it cannot, Accept is not offered at all and Decline is the only choice.

An extremely long plan is now shown truncated and the approval option is withheld, with a message telling you to send feedback asking for a shorter plan or press Esc.

Permission requests arriving from a worker, an SDK client or a direct socket connection are now checked for shape first. A structurally malformed permission request gets an immediate deny reading "Malformed permission request from worker" rather than reaching the approval dialog.

For tools this process does not know about, such as remote ones, the permission prompt now shows the tool name rather than a rendering of its arguments. The stand-in preview refuses to draw anything unbounded: more than three parameters, over-long keys or values, or oversized arrays and objects.

Sending a message between sessions that exceeds the size cap now raises a dedicated message_too_large error naming the actual character count and the limit, and suggesting you put bulk content in a file instead.

Approving a read-only listing of an artifact's assets now also covers saving that artifact's assets locally for the rest of the conversation, so you are not asked twice.

The multiple-choice question flow now knows whether screen-reader mode is on and builds its prompts and responses accordingly. When an option preview cannot be shown it prints "(preview cannot be shown in full — compare the option labels and descriptions instead)". Previews are now offered only for single-select questions that define one.

File-consent prompts, including ones answered remotely, now carry a flag saying the content was withheld, and a notebook past the byte cap resolves to an explicit "too large for preview" result the dialog reads instead of assuming content is there.

Paths displayed in tool-use lines and file access consent dialogs now pass through a sanitiser that removes or replaces control and non-printable characters before rendering, so a crafted filename cannot rewrite what you see when deciding whether to approve something.

Helpers now start from a locked-down environment: credential variables are stripped as before, and loader and interpreter hijack variables (LD_, DYLD_, NODE_OPTIONS, BASH_ENV, CLASSPATH, OPENSSL_CONF) are dropped too, with PATH, COMSPEC, ZDOTDIR, XDG_CONFIG_HOME and the git config paths pinned at fixed values pointing into an empty directory.

Chrome/domain, Skill, Bash-prefix, plan-mode and MCP permission dialogs no longer assemble a permission rule when you click the button. Each option is created up front as a row holding both its label and the exact rule it would write, and that rule is frozen and checked for being plain data before anything is saved.

The layer that converts messages arriving from a remote Claude Code session into local ones now checks every field instead of trusting it, so a malformed frame is dropped or repaired and logged rather than corrupting the local transcript.

Questions asked of you are now keyed by an identifier rather than by the question text, and carry a display object with the text plus a flag that renders multiline questions with a gutter. Option previews became tagged objects, so a preview can be withheld rather than always rendered.

Every git subprocess on this path now runs with -c advice.graftFileDeprecated=false and GIT_GRAFT_FILE pointed at /dev/null, so a graft file in a repository cannot rewrite the commit history Claude Code sees.

"Session webhooks are not enabled for this organization" is now classified as org_not_enabled like the equivalent tool message, a stalled response stream is classified as api_timeout whenever the error is a stream idle timeout rather than only when the text starts that way, and a second auth failure class now reports as auth_error.

Calls to the "frame" API host now set maxRedirects: 0, and the shared request helper defaults to 0 for that host. Redirects used to be followed, which could pass credentials on to whatever the redirect pointed at.

Feedback submissions are now measured before upload and trimmed to 8388608 bytes (with 65536 bytes of headroom) instead of failing, so long sessions can still file a report.

When a NotebookEdit approval cannot show the cell being changed, it now prints the reason inline instead of an empty diff: the notebook is too large for preview, the preview is unavailable, or the cell was not found. The message notes that approving still applies the edit to the real cell.

Consecutive completion notices are collapsed by kind, so a batch of finished remote tasks reads as a single "remote tasks completed" summary rather than one line each. Only bash completions are registered in the background-command map.

The "Yes, during this session" choice on a permission prompt is now built from the rules, mode and directories the answer would grant, rather than a hand-written label per case, so the wording matches what is really being allowed.

Markdown output now numbers nested ordered lists by depth: a/b/c at depth 2 and roman numerals at depth 3. Continuation lines of a list item are indented to line up under the marker.

Loading a notebook for an edit preview now returns a structured result, so an over-size notebook is marked as too large rather than coming back empty. The diff view can distinguish "too big to preview" from "there was no previous content".

The session view for Claude Code on the web used to walk every assistant message and tool-use block on each render to count agents and tool calls. It now reads those counts and the last tool used from a stored per-session stats record. Same display, far less work on long sessions.

When language-server support is unavailable, the tool now checks whether startup actually failed and returns the recorded failure text instead of an unexplained internal error.

If a bug report fails to submit because the payload is too large, the transcript attachment is unchecked for you and you are returned to the review screen to send it without.

If the remote arming of a policy helper changes while the helper is still executing, its result is thrown away rather than applied, and a warning appears prefixed "remote policyHelpers entry not run: ".

Subagent guidance no longer claims that leaving the subagent type out starts a fresh agent; it now says only that other values do. The artifact tool description attributes the current user id to the page's user capability rather than to a specific function call.

Counting and rewriting history.jsonl now raise an error saying the file was not rewritten when the history file is a symlink or not a regular file, or when the read or rewrite is declined, instead of failing quietly.

The notice now reads "Remote session couldn't switch to" rather than "Cloud session", and names the mode the way it appears in the UI instead of showing its internal id.

The local socket messaging error no longer hardcodes a 1 MiB buffer figure; it reports the configured limit and describes it as a line length.

When you approve a Claude Design read_db, write_db or watch call, the approval now records which action and which project it was for and re-checks that at execution time. If the action or the target URL changed after you approved, the call is refused with a db_target_changed error instead of running against a different database.

Approving an artifact tool call now attaches a hidden marker recording exactly which action and which project were approved. Before the privileged step runs, that marker is read back and must match the action and project actually being executed, otherwise the call fails with asset_target_changed.

Three guards land together so a malformed or handler-crashing message is dropped rather than crashing or producing an empty error.

When Claude Code builds a placeholder for a tool name it does not have loaded, it now decides whether the tool is an MCP tool from the mcp__ name prefix instead of always answering no. Permission rendering and rule matching now treat those names as MCP tools even when the real tool is unavailable.

Substituting {{name}} in a prompt or command template now requires the key to be defined directly on the supplied values. Names inherited from JavaScript's base object, such as constructor or toString, are left as literal text instead of being replaced with function source.

Multiple-choice questions now identify each question and option by a stable key rather than by the text shown on screen, with display text carried separately. Selecting, restoring focus and looking up answers all use the key, so two options that read the same no longer behave ambiguously.

/plugin reload against a remote session no longer fails when the remote reply omits some counts. Each of plugins, commands, agents and MCP servers is optional, and if none are present the command reports "Reloaded on remote." rather than erroring.

The context-usage command and the feedback/review path now validate what the remote sent back and tell you the reply cannot be displayed by this version, instead of rendering blank or proceeding with malformed data.

If the editor is handed an initial mode of VISUAL or VISUAL LINE, it starts in NORMAL instead. Mode changes made after the editor is mounted still apply exactly as given.

A batch of small corrections across messaging, feedback and file handling.

A new check reports whether a remote feature flag was actively served as off, as opposed to simply having no value and falling back to a local default. The device bridge uses it to decide whether to keep running, logging stopping: the gate turned off with reason gate_off.

Asciicast terminal recordings gain a path that stores them under a recording key namespace keyed by project, session and timestamp, with the recording list merging stored entries and on-disk .cast files. Only taken when the storage backend flag tengu_hover_rest is on and a storage handle exists; otherwise recordings stay plain files.

Caching a plugin version can now build the entry in a staging directory and move it into place atomically, with named handling for interrupted or concurrent writes. It runs only when the storage backend flag tengu_hover_rest is on, which is off by default; otherwise the old copy-in-place behaviour is used.

When setting up evals, the command takes the directory from --eval-dir or the plugin manifest's experimental.evals, refuses to read a manifest in a directory whose ownership it cannot confirm, refuses symlinked or foreign-owned output locations, and removes any directories it created if setup fails.

Before running, the eval command reads the component paths declared in plugin.json (commands, agents, skills, outputStyles, themes, workflows, monitors, mcpServers, lspServers, hooks), follows symlinks into the real tree, and reports when the eval directory sits inside one, because files written there could be loaded as plugin components.

Calls out of the artifact sandbox into Claude Code can now run a sanitize step inside the sandbox before the host side sees the value, so host code never reads through sandbox-controlled property traps while validating or checking consent.

Mutable state that used to sit at module level, shared by everything running in one process, now lives in lazily created holders keyed on the session, reached through getters rather than read directly. Two sessions in the same process no longer share it. Alongside that, the top-level UI provider and the message list take their dependencies explicitly instead of pulling them from ambient state or from long prop lists.

When a claim on an adopted session is found stale, its live entries are now returned marked stale with a backfilled write timestamp instead of being discarded. Only a stale claim with no entries at all still returns nothing.

Design-tool consent, plan and grant state is now looked up per session and passed through permission checks, the grants fetch, the plan store and the project-grant observer, which takes it as a second argument. The MCP OAuth callback submitter map, artifact auto-react store, timer registries, remote-settings verdict cache and API key cache moved into per-instance holders too. This matters for background and multi-session runs, where these used to be shared.