Claude Code v2.1.238

The switch controlling the design canvas command, tengu_ethereal_nova, now defaults to on instead of off, so with no server-side value the design slash command registers and appears in the menu as "Draft a design on a canvas Artifact — editable where saving is enabled (Claude Design preview)". Two further conditions still apply: artifacts must be enabled for the account, and the Artifact tool must advertise a capabilities field. Whether it is on for a given account is still decided remotely.

A new verify action lets Claude read what real viewers' browsers recorded for the artifact version it just published: console output, uncaught errors, failed resource loads and failed capability calls. It is off in this build. The action only enters the tool's schema when CLAUDE_CODE_ARTIFACT_VERIFY is set, otherwise when the tengu_osier_pylon_trace server flag is on; with neither, the compiled fallback is false and both the permission path and the handler answer that verify is not available in this session.

If a plugin fetches its archive using headers minted by a local helper command, installing or updating it now shows the exact command and destination and waits for confirmation. Non-interactive runs are recorded as "unconfirmed" and abort. Inside a Claude Code session, -y/--yes is ignored and you are told to run the install in your own terminal. Autoupdate never runs the helper at all.

In -p mode, Claude Code can build the query engine once and submit each prompt to it, keeping the model, tools, MCP clients and read-file cache warm across prompts, instead of rebuilding everything per prompt. Set CLAUDE_CODE_PRINT_ENGINE_LOOP to use it; unset, the existing per-prompt path runs.

When Claude Code copies your working files up to a cloud or lane session, each path is now checked against a credential test and refused outright instead of uploaded. .mcp.json and .claude.json join .claude in the set of sensitive names.

Reads of agent memory files, auto memory files, the tasks directory, the teams directory and bundled skill reference files were previously allowed without a permission check. When the request comes from a remote surface, those shortcuts are now skipped and the read goes through the normal permission flow.

A complete broadcast-channel feature for artifacts ships in the code, including a room_send action, its approval copy, validation, result rendering, a topic/data argument pair, a rooms section in artifact status and join-on-publish machinery. None of it is reachable, and no flag or environment variable can turn it on.

The artifact tool can declare a room capability, an at-most-once broadcast channel to whoever is currently viewing the page, sent with room_send carrying a topic and data, alongside the verify action that reads runtime diagnostics viewers' browsers captured for the current version.

The new v5 storage backend for credentials and settings can now be pinned with the CLAUDE_CODE_HOVER_REST environment variable, which takes precedence over the tengu_hover_rest server flag. That flag's built-in fallback is false, so the v5 backend stays off unless the server enables it or you set the variable.

Before asking whether to sync your checkout to a cloud session, Claude Code now measures the repository and picks between starting from a remote ref, uploading a bundle, or deferring. Every refusal now comes with a stated reason. Bundle upload itself is gated by a server flag with no built-in default, so it is off unless the server enables it; CCR_ENABLE_BUNDLE=true forces it on locally and CCR_FORCE_BUNDLE skips remote detection.

A marketplace or plugin entry can declare headersHelper, a shell command whose JSON stdout becomes the HTTP headers used to fetch that marketplace or plugin archive, so short-lived tokens replace static headers. It runs only on explicit install, update or refresh, after you have seen the exact command, and is controlled by the kill switch tengu_plugin_command_source_refresh, which defaults to on. Managed settings disableCommandPluginSources and allowManagedHooksOnly block it entirely.

Every result message the SDK emits carries a new subagent_stats block summarising the subagents the Agent tool started this session. It is on the published result schema as an optional field marked internal, ships to every SDK consumer on this build with no flag, and is attached on success, on budget exhaustion, and on both structured-output retry-exhaustion errors.

CLAUDE_CODE_SILENT_TURN_REMINDER, CLAUDE_CODE_SILENT_TURN_REMINDER_TURNS, CLAUDE_CODE_SILENT_TURN_REMINDER_TEXT and CLAUDE_CODE_ARTIFACT_ROOM joined a set of recognised environment variables that already held entries such as CLAUDE_CODE_HARBOR_KITE and USER_TYPE.

The reminder injected after several silent turns is no longer a fixed string. It reads CLAUDE_CODE_SILENT_TURN_REMINDER_TEXT first, then a remote-config value, and falls back to the built-in text when the configured value is empty.

Before a Remote Control bridge session starts, Claude Code checks that the device is enrolled as a trusted device. If it is not, the session is skipped, the reason is logged, and the failure is reported as either terminal or an auth problem.

If the device-binding check for this machine does not come back confirmed, directory sync permanently turns off the pull direction for the session and tells you so. Your local edits still go up to the cloud session; nothing comes back down. Skipped pulls are reported with the reason skipped_unbound.

Cloud sessions gained an outputs push: after a turn, files under the outputs root that were modified since the turn started are read and POSTed to the session worker under a /outputs path. It runs only when a remote session id is set and the environment is anthropic_cloud, and the server can switch it off.

The Skill tool's description was rewritten: background skills return only an agent name, skills can be named with a scope such as apps/web:deploy, and an already-loaded skill block should be followed rather than invoked again. In coordinator mode an extra paragraph is appended saying the coordinator's own use is read-only, with no forking, permission grants, hooks or preamble shell commands, and that execution happens in workers.

The cache that remembers MCP server discovery between runs was previously armed with a kill switch defaulting to on. It is now controlled by tengu_mcp_discovery_cache_enable, whose built-in fallback is null, so it reports "not-enabled" unless the server returns true or MCP_DISCOVERY_CACHE is set to exactly true. Everything else in this release's MCP account-switch rework hangs off the same check and is therefore dark on a default build.

The flag deciding whether Claude Code uses file-based memory or the newer memory tools changed name from tengu_stone_shell to tengu_linen_orbit, both defaulting to off. Renaming resets whatever rollout the old name carried, so without a new server value every install is on file-based memory. The organization-memory variant needs a second flag, tengu_haze_glass, also off by default.

Claude Code can now take the default permission mode and effort level from your local settings, forward them into a session started with claude --remote, and report at startup what it decided. Both halves sit behind remote feature flags that have no value compiled into this build, so with no server configuration a remote session still starts without your local permissions.defaultMode and nothing about the decision is reported.

Claude Code now refuses to carry MCP tool calls, re-authentication, and reconnects across a switch of the signed-in account, so work started under one identity is never completed under another. A tool call that reaches a re-auth path is cancelled, pending re-auth started under the old account is refused rather than reused, and a reconnect that spans the switch fails and asks you to try again. The whole path depends on an account-change counter that only advances while the MCP discovery cache is on, and that cache is off in this build, so none of it can be observed on a default install.

A program driving Claude Code over the SDK or a remote connection can now stop one running task by id, instead of interrupting the whole turn. It joins interrupt, set_permission_mode and set_model in the accepted control requests, and only works if the host program has registered a handler for it.

An MCP server can now be marked disabled for a project and shows "Disabled in /mcp" with its own status badge instead of a generic failure. Connection errors gained three codes: POLICY_BLOCKED for a server blocked by enterprise managed policy, DISABLED for one turned off locally, and IDENTITY_CHANGED for a reconnect that raced an account switch.

Streaming connections and the bridge credential fetch now check whether a 403 came from Anthropic's own servers or was injected in front of them. A 403 from something else is treated as a temporary outage: the connection keeps retrying instead of giving up, and the bridge treats it as unreachable rather than as a real refusal, until it repeats past a threshold and is finally accepted as one.

If an agent's frontmatter declares MCP servers inline rather than by name, and the folder the agent is defined in is not trusted, those servers are now dropped for both the main thread and subagents. A log names the source and tells you to accept the trust dialog or set hasTrustDialogAccepted. There is no flag: this applies to anyone whose agent files live outside a trusted project.

Plugin install shows a "Configure <plugin>" dialog for each configuration step a plugin declares, both for the plugin's own options and for each channel server's options. The dialog only appears when the plugin manifest declares them; while it loads you can cancel with the confirm-no binding, which skips configuration entirely.

The folder-trust screen lists commands the repo's own settings would run to mint HTTP headers, alongside the existing marketplace, OpenTelemetry and proxy helper warnings, so a repo cannot introduce a command that runs on first fetch without appearing in the prompt.

A new settings key, keybindingFlavor, picks which editing-key conventions the prompt input follows. Set it to "readline" and Ctrl+W deletes back to the previous whitespace, the way Bash and other readline programs behave. The default when unset is "classic", which keeps the long-standing behaviour of deleting the previous word. No experiment flag is involved; anyone who sets the key gets it.

The instructions Claude follows when building an artifact gained a section on what to do when an idea needs real data or real actions, and it tells Claude to load a named capabilities skill before relying on any of them.

When a skill is loaded read-only, the tool result is now an explicit note that the instructions were loaded, nothing ran, and execution should be delegated to a worker, instead of the usual result payload.

When a skill is loaded in read-only preload mode on the coordinator, any Bash-style command inside that load is not executed. The model gets back an explanation telling it to delegate the command to a worker instead.

Two new record types are appended to the session transcript so that automatic replies to artifact comments carry across resume, fork and clear, and so a session can hand its intent to a successor. Reachable only where the artifact comment auto-reply opt-in is on: CLAUDE_CODE_ARTIFACT_COMMENTS_AUTOREACT, or the tengu_sorrel_trellis flag, whose compiled fallback is false.

Identity for talking to other sessions is now derived from the host plus the current credential (account and organization ids, or a fingerprint of the bearer token) and recomputed when the account changes. This sits under cross-session messaging, whose compiled fallback is false: it needs CLAUDE_CODE_HARBOR_KITE set, or the tengu_harbor_kite flag on, and on Windows also tengu_harbor_kite_win, which also falls back to false.

Stopping an agent still stops every other running agent with it. New in this build is the machinery to exempt some of them: each other agent is tested against a list of exemption rules and, if exempt, added to a "spared" list instead of being killed. Nothing in this build ever adds a rule to that list, so no agent is ever spared and stops cascade exactly as before.

When a headless session resumes and finds a permission request that was left unanswered, and that request does not belong to the interrupted turn's tools, Claude Code can now hand it back to you as an adopted prompt, and on a denial or a timeout retire the interrupted turn rather than re-running it. This needs CLAUDE_CODE_ADOPT_UNDERIVABLE_PARKED_PERMISSION set plus either CLAUDE_CODE_HOLD_UNANSWERED_PARKED_PERMISSION or CLAUDE_CODE_RETIRE_UNANSWERED_PARKED_PERMISSION. All three are unset by default.

The safety classifier can now compute a severity score at two additional decision points, agent handoff and sandboxed network access, alongside the existing workflow gate. Each site carries per-model score thresholds. Severity is only computed when server-side config lists the site as on, so with no server value both new sites return no severity and change nothing.

Headless and SDK sessions gained a check that runs before every turn: registered participants are asked whether the turn may start, and a refusal ends the session with "This session cannot continue: a required step before the turn did not complete." Only one participant is ever registered, the directory-sync pull, and it always answers ready, so no code in this build can actually refuse a turn.

Session registration now tracks whether a session was created spare and polls to claim one, and reports itself as spare when registering. This points at sessions started ahead of time and handed out when needed. Nothing in this build shows spare-session creation being reachable by default, so whether any are made is decided elsewhere.

Separately visible in the bundle, the fallback value for this feature switch changed from false to true, so with no server-side answer it now resolves on for accounts that also pass the capability check it is combined with. The bundle only shows the fallback; the live value still comes from remote config.

Three new remote-bridge feature checks appear, all defaulting to on when the server says nothing. tengu_dazzling_garden guards a second OAuth recovery attempt after a forced token refresh is rejected. tengu_bridge_host_declined_end and tengu_bridge_signed_out_neutral are present in the build, but what reads them is not visible from the flag definitions.

When a program connects to Claude Code over the stream-json control protocol, the reply now includes session_state (idle, running or requires_action at the moment of connection) and hooks_applied. A client attaching to a CLI that is mid-turn can see that immediately instead of guessing.

In stream-json input mode, hooks are no longer fixed at first connect. The process that owns the stdin stream can send a second initialize whose hooks replace the earlier set, and the reply's hooks_applied says whether that took effect.

Administrator-managed settings can now block plugins and marketplaces whose entry source is not listed in the managed extraKnownMarketplaces policy, so install, update and refresh stop with a policy error instead of running that entry's command for minting auth headers. Refusals are reported separately from ordinary failures, and the messages name the policy rather than looking like a network or catalog fault. Nothing is blocked unless the managed policy sets disableCommandPluginSources or allowManagedHooksOnly; without those, behaviour is unchanged.

The self-hosted runner can now authenticate to an outbound HTTP proxy with a token it generates fresh for every connection, via --proxy-authorization-command / SELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_COMMAND or --proxy-authorization-file / SELF_HOSTED_RUNNER_PROXY_AUTHORIZATION_FILE. Set exactly one. It is off unless you set it, and the help text says it is not yet supported with the orchestrator subcommand.

Marketplace catalog entries and plugin entries declared in settings files both accept headers and a headersHelper command, so an archive no longer has to inherit authentication from the enclosing marketplace. -y, --yes now also consents to the helper command used to fetch an archive, and on updates to a changed install command.

When a tool call reaches an MCP server whose connection failed, the error message now appends the underlying failure text instead of ending at the server name. The suffix appears only when the server is in the failed state with an error recorded, and is suppressed entirely when the MCP subsystem is kill-switched; the stable second argument stays "MCP server not connected".

When an MCP server connection is re-established, Claude Code now checks whether a newer connection attempt has started since. If so it closes the connection it just made and publishes nothing, so a late-arriving reconnect cannot replace the tools, prompts and resources of the connection you are actually using.

When a corporate proxy or CDN refuses the CONNECT tunnel, the error now says so instead of surfacing as an Anthropic 403. The failure carries code ERR_PROXY_TUNNEL plus the CONNECT status and headers, and the explanation names a CDN or a VPN/firewall refusing the request before it reached Anthropic.

When a session reconnects and the server replays earlier messages, those echoed user messages are now dropped with a debug log instead of being fed back into the prompt, which used to produce a duplicate turn.

When a skill is invoked as a slash command, the invocation no longer sets its own model and reasoning effort. It inherits whatever the session is already using instead of overriding it.

Parsing of background session records now reads a spare boolean, and the telemetry around claiming a spare session survives a reworked spawn path. What decides when a spare session is actually spawned is not set anywhere in this build.

A startup notice offering "Get more out of Claude Code on Claude Enterprise" with a link to claude.com/enterprise. It shows only when a server-side flag, tengu_velvet_harbor_owl, returns a cohort of has_ce or no_ce; its fallback is "off", so nobody sees it without that server value. It also needs an org role of admin, billing, owner or primary_owner, a per-user seen count under its cap, and a local (non-remote, non-bridge) session.

A new environment variable lets you point artifact syncing at a different host, alongside the existing asset, live and viewer base URLs. Unset by default, so nothing changes unless you set it.

Arming a durable wake subscription is tracked while in flight and settles to registered, stopped, pending or unregistered. Failures show up as a durable_wake line in the artifact status output and as a one-shot notification, with a reason instead of silence.

Pointing the gateway's key-set URL at loopback is now rejected unless CLAUDE_GATEWAY_ALLOW_LOOPBACK is set, because the safe-fetch layer would block every such fetch at runtime anyway. The variable is absent by default and the surrounding errors say it exists for tests and must never be set in production.

Results from the skill tool now carry an optional readOnly flag, set when a skill's instructions were loaded without anything being run. Anyone consuming skill results through the SDK or the streaming output can now tell a read-only load apart from a real execution.

A tool call to a server that exists only as a cached discovery entry can now dial it on demand rather than failing, and /mcp re-authentication clears the cached entry before reconnecting. Both depend on the MCP discovery cache, enabled only by setting MCP_DISCOVERY_CACHE to true or by a server value, and off otherwise.

The code selecting the v5 storage backend checks CLAUDE_CODE_HOVER_REST before falling back to the tengu_hover_rest flag, whose compiled fallback is false.

Starting a cloud session that cannot ship your working tree now says no session was started and why: either the local changes were too large, or bundling them failed. Both messages point you at --ref <branch> to start from GitHub instead, with file sync off.

The command now prints a per-outcome summary counting marketplaces attempted, refreshed, refused by policy and failed, and explains why any were skipped. The exit code is non-zero when at least one marketplace failed, so scripts can act on it.

When fetching an image or file attached to an artifact is blocked by network egress rules, the error now says which frame host was refused and tells you to allow *.frame.claudeusercontent.com (and its staging variant) in your sandbox or desktop app network settings.

Hooks on the UserPromptExpansion event can now return a flag that keeps the user's original prompt text out of the message shown when the hook blocks the prompt. This matches what the prompt-submit hook could already do, and works on this build with no flag to enable.

The kill-word-before binding now chooses between deleting back to the previous word boundary and deleting a full whitespace-delimited WORD, depending on the editing mode, matching vim's WORD semantics.

Catalog validation gained errors and warnings for fetch credentials: an entry using headersHelper must inline its full manifest or the helper will not be run, headers/headersHelper on non-archive sources warn as ineffective, and an archive fetched with a helper but no sha256 warns.

Spoken announcements now go through a queue with a bounded buffer instead of firing immediately, and a quiet window suppresses them during startup until an explicit end point. This runs under the existing axScreenReader setting.

New flag --defer-shutdown-max-min <m> makes the first SIGTERM stop the runner accepting new work while it keeps serving attached sessions, rather than starting the drain budget straight away. It writes SELF_HOSTED_RUNNER_DEFER_SHUTDOWN_MAX_MS; 0 disables it and is the default, so operators who do not pass the flag see no change.