Claude Code v2.1.236

The application hosting the agent can attach a note after a tool result, and the safety classifier now sees it as its own transcript line. Two kinds exist: host_context_live, attached during this session, which may relay real user input and can satisfy a soft block's consent requirement, and host_context, restored from saved session state, which never establishes user intent. The classifier prompt describes both. Emission of the live variant has a kill switch, tengu_disable_live_host_context.

A new startup tip with the internal id claude-design-command suggests running the /design command before building UI, reading "Working on UI? Run /design to mock up a few directions before you build". It is present but inert in this build: showing it needs the allow_design_sync account entitlement and then a feature flag whose fallback is false, so no one sees it yet. Alongside it, the tip engine gained two general behaviours that apply to all tips.

A session can be asked to send exactly one notice when it next finishes its turn or exits. The receiving half is live on this build with no flag check at all: any session here will accept and honour such a request. Only the ability to ask is dark, because the tool parameter is added to the schema behind tengu_harbor_kite (fallback false; CLAUDE_CODE_HARBOR_KITE forces it on; Windows also needs tengu_harbor_kite_win, fallback false).

PostToolUse hook responses accept a new optional classifierContext string, carried alongside the tool result to the classifier that decides permissions in auto mode. It is capped at 2000 UTF-16 code units shared across all hooks for a single tool call, honored only on synchronous hook responses, and dropped if the paired output rewrite is rejected or superseded. Anyone writing a hook on this build can use it.

Shared memory stores, previously documented as unsupported outside Anthropic-hosted sandboxes, now work on your own infrastructure. The Python, TypeScript, and Go worker downloads each attached store to /mnt/memory/<store-name>/ and re-syncs it on an interval, default 15s with a 5s floor, tunable via memory_sync_interval / memorySyncIntervalMs / MemorySyncInterval. Deletion handling is set by memory_sync_deletes (enabled default, log_only, disabled).

A cloud or remote session can now broadcast a permission mode change and have the local session adopt it, provided the mode is one of the allowed values and the local validator accepts it.

The model for a session now resolves from the --model flag, then the ANTHROPIC_MODEL environment variable, then ANTHROPIC_DEFAULT_MODEL, and only then the model Claude Code ships with. An organisation or a shell profile that exports the variable will see it take effect in sessions that previously fell through to the built-in default, and the model list marks the choice so you can tell where it came from.

Message shapes are defined for a claude --cloud client to register its local hooks with the cloud worker: an inventory of hooks by opaque id (command or HTTP, matcher, timeout, which settings file it came from), a list of vetted in-container templates pinned by sha256 digest, and a lease in seconds, answered with the project directory, working directory, lease expiry, accepted and ignored counts, and whether it replaced a previous owner.

A new publish mode lets Claude start a private artifact on claude.ai from a published "Artifact type", a template whose page and settings are fixed by its publisher: pass type_url and your own files land alongside the type's. It is held shut by two independently gated server flags, both defaulting off, plus a local-only check, so nothing here is reachable in this build without server config. Reading and publishing into an artifact that already came from a type are unaffected by these gates; only creation from a type is suppressed.

Each running Claude Code writes a fixed one-element feature list into its entry in the local session registry, marking itself as able to send idle notices. This is written with no flag check, so builds shipping now become discoverable as idle-capable ahead of the user-facing half.

The events reference now describes the Console session viewer, available to Developers and Admins: a filterable session list, a per-thread timeline minimap, a transcript grouped by model request with a filter box and JSON export, and a five-tab Inspector (Session, Events with a Deltas view, Tools, Resources, Threads) toggled with the d key. It also documents appending ?event={event_id} to a session URL to link straight at one event, suggested for error reports.

The three settings behind the total-tokens reminder (its mode, its budget, and whether it appears after your turn) are read first from a configuration blob the server sends, and only fall back to the feature-flag defaults "padded-countdown", the default budget and on. The CLAUDE_CODE_TOTAL_TOKENS_REMINDER environment variable and the totalTokensReminder settings key still override both.

The bundled platform availability reference no longer lists self-hosted environments on Claude Platform on AWS as "Not available". The self-hosted sandbox row now marks them supported and spells out how workers authenticate, how long a session can run unattended, and what a self-hosted session on AWS cannot do.

The non-interactive entrypoint now watches its own session state, records which peers are idle, and queues incoming idle notices for the model, waking the loop the same way an incoming peer message does.

When you resume a session, Claude Code no longer silently re-enables automatic replies to comments on published Artifacts. It re-arms only what it can, and prints a reason for each one it skipped: you stopped watching it last time, this account cannot publish to that Artifact, another session may already be replying, it could not confirm no other session is replying, or you are already watching the cap of 5 Artifacts at once.

The optional live_doc input and its gate branch are removed from the artifact tool schema, and the live-doc prompt block no longer ships in the tool description. The document skill now carries a marker saying it is live-doc backed instead.

When Claude works for several turns without saying anything to you, a hidden reminder can be added to the conversation: "The user hasn't heard from you in a while. As you continue, keep them updated when there's something to tell". It is off unless CLAUDE_CODE_SILENT_TURN_REMINDER is set or the model in use declares support for it, and no model in this build does, so by default nobody sees it.

The two places that upload your repo for a cloud session now pass the option that refuses uncommitted credential files, reading it from a remote setting that falls back to off if it cannot be read. The option name existed before this release but was never passed to the upload path.

Claude Code can now ask, once, whether you want auto mode to become your default permission mode, and the interactive session checks at startup whether to queue that question behind whatever is already on screen. The prompt takes an accepted, declined or cancelled answer. Both the prompt and the startup check are present in this build but switched off, so nothing appears unless remote config turns them on.

The newer v5 session-storage backend used to be consulted wherever a caller happened to check tengu_hover_rest or simply passed a v5 handle. This build reads the flag once at startup and pins the answer, and every v5 path now checks the pinned value too: session file writes, plugin listing, sidecar writes, session-metadata re-append, config backup listing, and skill and plugin existence checks. Passing a v5 handle is no longer enough, and the choice cannot flip mid-session.

Artifact database reads take an out_dir and write each returned document to disk as a JSON file instead of pulling it into the conversation. The result line reports how many documents were saved and how many were skipped.

Artifact database writes accept file_path pointing at a local JSON file whose top-level object becomes the document, so a large document no longer has to pass through the conversation. Exactly one of inline data or file_path is required; giving both or neither is a validation error.

A disallowedTools entry naming a tool now also blocks the batched wrapper around that tool. Previously a rule written against the original name did not stop the wrapped form.

CLAUDE_CODE_TUI_TRIAL=fullscreen starts a session in the fullscreen renderer without saving the choice; it is read once at startup and then removed from the environment. The prompt offering fullscreen can be forced with CLAUDE_CODE_FORCE_FULLSCREEN_UPSELL, and is suppressed once you have a tui setting, under tmux control mode, on Windows SSH, and after it has been shown 3 times.

The artifact list gained a fourth filter tab for pinned artifacts, a p key whose label flips between pin and unpin, and sorting that puts pinned artifacts first. The switch is not a local flag: the list response carries a starsEnabled boolean, and when the server omits it the tab is dropped, the pin action disappears, and a selected pinned filter is rewritten back to "all".

Accepting the fullscreen renderer prompt no longer writes the setting straight away. Claude Code relaunches into a trial and only saves tui: "fullscreen" if the session stays healthy. Separately, each fullscreen launch is recorded before the first frame and cleared 10 seconds after it; a launch that dies first counts as a strike, and 2 strikes disable fullscreen on that machine for that version. /tui fullscreen retries, and CLAUDE_CODE_NO_FLICKER=1 still overrides.

The check that decides whether a prompt is too sensitive to save now sees the actual pasted text, not just a flag saying a paste happened, so a command with a secret pasted into it can be kept out of history. Only text pastes are inspected. Setting CLAUDE_CODE_SKIP_PROMPT_HISTORY still disables history entirely.

Before packaging your checkout for a cloud session, uncommitted files with credential-looking names abort the upload. Bundling also gained a cheaper tier that packages only the branch you have checked out plus the current commit, instead of every branch.

The hint asking Claude to wrap up the current step as you approach the limit now uses a threshold that depends on your plan: 0.99 on Max 5x, 0.9975 on Max 20x, and a default otherwise. It fires at most once per five-hour window instead of every time you cross into the near-limit zone.

The macOS sandbox profile is now assembled from explicit allow, deny and writable-root lists, and adds a further section that reinstates your denials for any path that happens to sit inside a folder Claude Code is allowed to write in. Granting write access to a directory no longer quietly reopens a file you had denied reads on inside it, and denied paths under a writable root can no longer be deleted or unlinked.

The artifact publish result gained branches choosing between a gate-closed, streaming or remote suffix, plus a note about durable arming. Every one of them is reached through a module handle declared as null and a boolean declared as false that nothing in the build ever assigns, so none of it can run and no server-side config can enable it.

After a run of tool results, a short reminder text can be inserted into the conversation, chosen by matching the model you are using against a list of model name patterns. The text comes from the CLAUDE_CODE_TOASTY_THIMBLE environment variable, or from server-supplied config; with neither, nothing is inserted.

A new API address builder for fetching a plugin belonging to an organization, with an optional parameter to pin a specific version.

Claude Code can now compress outgoing API request bodies with gzip, decided per request by a helper that records exactly why it declined. It only applies on the Bun runtime, only to string bodies of at least 4096 characters, and never over unix sockets, proxies, mTLS or custom CA setups. Both remote gates default to off, so nothing is compressed in this build without a server-side value, and a rejected compressed request falls back to sending uncompressed and stops compressing afterwards.

The application embedding Claude Code, or a hook running inside it, can now supply extra context that travels with a tool's result message and is shown on its own line in the transcript. Hook output handling copies a classifierContext field out of a hook's response alongside the additional-context and rewritten-output fields it already reads, and messages carry a matching field that is read back when the tool result is assembled. Nothing changes for anyone who does not supply that context, and the path is guarded further before it is consumed.

Messages sent between sessions on the same machine when one goes idle can now be stamped with the sending session's permission mode, as bypass or prompting. The stamping helper returns nothing unless the gate tengu_harbor_kite_mode_emit is on, and it falls back to false in this build, so no mode is attached.

The reminder described above is a new attachment type that latches into a conversation once per model, taking its text from a server-supplied map of model pattern to reminder text or from CLAUDE_CODE_TOASTY_THIMBLE. With neither present, nothing is injected.

The set of remote-control actions that currently do nothing gains detachTerminal beside clearStatus, toggleQr and refreshDisplay, and a new helper filters a stored list of surfaces seen against the allowed list "mobile", "web" and "desktop". Groundwork for showing remote-control tips per surface.

The tool Claude uses to message another session on the same machine gained a notify_when_idle input that subscribes to a single notice when that session next goes idle or exits; sent without a message body it is a pure subscription. The parameter is only added to the tool schema when cross-session messaging is on, so with the gate off the model never sees it.

An artifact created from a type carries a lock recording which files belong to the type. Claude is told those files cannot be edited here, and publishing an index.html to such an artifact is refused because the page comes from the type. None of it is reachable without the two artifact-type flags, both of which default off.

Agents can now stop with a reason of subagent_park, and it is treated like an interrupt, a background move or a shutdown: an ordinary stop, not a teardown failure.

The largest change in this release, invisible on its own: dozens of caches and counters that lived once per process now live in a container looked up from the current session. This is the groundwork for more than one Claude Code session sharing a single process without sharing state.

Which Artifacts a session watches for comments is stored as its own session-log entry with a schema and a version number, replayed as last-wins when session state is rebuilt, and explicitly cleared when a session is forked or moved.

Whether auto mode sees repository visibility is now decided by the CLAUDE_CODE_AUTO_MODE_REPO_VISIBILITY environment variable, falling back to a repoVisibility config field that must be exactly true. It is off unless you set one of them.

Pacing of Harbor requests now has an explicit off switch instead of a per-turn latch. Set CLAUDE_CODE_HARBOR_KITE_PACING_OFF to turn pacing off, or it can be turned off remotely by the tengu_harbor_kite_pacing_off flag.

When a run stops because the USD budget is used up, the result comes back with subtype: "error_max_budget_usd" and is_error: true, so scripts can tell budget exhaustion apart from other failures.

The worker no longer exposes run_one() / runOne(). The replacement, handle_item() / handleItem() / HandleItem(), services one work item that has already been claimed and reads its identifiers from ANTHROPIC_* environment variables, so claiming is now the job of run() or the mid-level poller. The file-tool option unrestricted_paths is gone and raises if passed; use allowed_roots or read_only_roots instead.

If restoring a previous session fails, Claude Code prints an explicit exit message naming the underlying error and pointing you at claude --resume to pick a session or start a new one, then exits with status 1. Previously the failure was only logged and the process carried on silently.

If the code drawing the interface throws and cannot recover, Claude Code prints a message saying it exited after an interface error. When the fullscreen renderer was still starting up, it also says the next launch will use the classic renderer and that CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1 forces that renderer.

The artifact list adds a pinned view next to mine/shared/all with its own count, p to pin or unpin the highlighted artifact, and ctrl+r to rename one inline with a confirm step.

Submitting the prompt while a slash command is typed now resolves the best matching command and executes it, rather than sending the text as a message. The matcher behind command search was also rebuilt with an explicit ranking order.

Fetching the model list and switching models on a cloud session are both waits you can now escape from instead of watching a spinner indefinitely. The picker shows a cancellable line with an escape shortcut while it loads, the underlying request carries an abort signal and a timeout, and cancelling gives you a specific message telling you what to do next rather than a generic failure.

The internal git call Claude Code uses to detect which files have changed now runs with --no-ext-diff and --ignore-submodules=all. A custom diff program set through git's diff.external setting is no longer invoked by that call, and activity inside submodules no longer affects the result. This removes a source of slowdowns and odd output for anyone with an external diff tool configured, and it applies to everyone with no flag or setting to turn it on.

If the normal exit fails, Claude Code now kills its own process outright rather than sitting there. Shutdown also handles SIGHUP alongside SIGINT and SIGTERM, the UI teardown resolves or rejects the exit promise so anything waiting on it is released, and pending events are flushed before the internal event channel closes.

The panel showing extra usage previously appeared only on Pro and Max plans. It now renders for team and enterprise accounts too.

The patterns that find PEM private key blocks and replace them with [REDACTED] were shared across calls and carried a search position between them, which could skip a block or mark the wrong boundaries. They are now built fresh on each scan.

The artifact module exports a new flag constant pointing at the gate tengu_russet_pergola, which does not exist in the previous build. Only the declaration and export are present; no code in this build reads the gate, so it does nothing yet.

New helpers ask whether an assistant message begins with a "special" thinking block, requiring both a thinking string and a signature string plus a registered matcher. Where the answer is yes, the message stops counting as thinking-only for context assembly, the streaming thinking panel is cleared rather than updated, and the message is treated as a real assistant turn.

New address builders under /v1/code/agent-proxy for /frame and /artifact, a request-header helper carrying an asset token in x-frame-asset-token, and a new artifact_mount constant. Nothing in this build is visible in the product yet.

Bridge teardown now waits for the pending disconnect notice on both the normal and skip-archive exits. A new message-fetch entry point is present but hard-disabled: it always returns a failure with the reason feature_disabled.

The ccr-proxy MCP transport used to fall through to the legacy branch alongside sse, ws and ide. It now has its own check gated on tengu_mcp_protocol_negotiation_ccr: with the flag on it negotiates in auto mode with a probe, and with it off it stays on legacy exactly as before.

tengu_deep_feather is new and its fallback is true, so absent a server value it is on for everyone. It governs whether split message-tool inputs are reassembled, both when the tool reads its own input and when a prior tool call is re-read to recover its original message and idle-subscription values.

The remembered answer for whether the web fetch agent is used now lives on a state object rather than a module variable. The decision is unchanged: CLAUDE_CODE_WEB_FETCH_AGENT wins if set, otherwise the tengu_clever_orbit gate decides, defaulting to off.

A new reference document ships inside Claude Code, reached from the /claude-api upgrade flow, walking a project through the 0.x to 1.x migration step by step.

Pressing dismiss on a Claude-drafted feedback card now asks "Turn off Claude-drafted feedback?", with 0 to turn it off and escape to keep it. Confirming shows "Claude-drafted feedback is off - turn back on in /config". The offer appears at most twice; anything other than 0 counts as a decline.

A plugin eval case that supplies only a session history file is now refused; you need execution.prompt in case.yaml or a prompt.md body. A case or grader still containing the placeholder line written by init is refused with an error explaining that.

Each entry in an agent toolset's configs array is now one of eight per-tool shapes, picked by a type field that appears in responses even when you omit it in requests. Dict-based SDKs (Python, TypeScript, Ruby) are unaffected; Go, Java, C#, and PHP callers must build entries from the per-tool types.

The note after a publish names the terminal ways back to the artifact: /artifacts to list what you own or were shared, with o to open and c to copy the link, and ctrl+] to reopen the most recent artifact from the session. The web gallery is mentioned second rather than first.

The artifact list can rename an artifact in place through a "Rename artifact:" text field confirmed with enter and abandoned with escape, updating the list immediately and rolling back if the server call fails.

The disclaimer shown for Claude-drafted feedback now tells you the feature can be switched off in /config.