Claude Code v2.1.239

An agent running in a cloud session now sends its tool requests back to your local machine, so you approve or deny each one in the usual prompt instead of the remote run stalling or failing. These requests always reach you: the permission classifier that normally auto-approves routine tools is skipped for anything a remote agent proposes, and the dialog marks the origin with "from a remote cloud agent". Answers you give a remote agent never offer the "always allow" option, so nothing a cloud agent asks for can quietly become a standing rule.

The price table built into Claude Code adds a $2 per million input, $10 per million output tier and moves Sonnet 5 onto it from the previous $3/$15 tier. /cost and usage estimates bill against this table, so reported Sonnet 5 spend drops by about a third. Unconditional, with no flag involved.

When you hit the 5-hour usage limit, Claude Code can offer to keep working at reduced priority against your weekly allowance instead of making you wait, with a hidden /low-priority command, an entry on the usage-limit dialog, a waiting state, and its own retry and stop-reason accounting. Nothing appears unless the server both puts your account in the treatment arm through a response header and ships a config object named tengu_toasty_breeze with enabled set to true. That config defaults to empty, so enabled is false and the whole subsystem is off for everyone in this build.

Global config gained a modelSettings map keyed by model name, where each entry can carry an effortLevel of low, medium, high or xhigh. The existing single saved effort level stays alongside it.

A bundled skill publishes a self-contained drawing canvas as an artifact. You sketch on it, press Send to Claude to republish it, and Claude answers by adding its own elements in orange ink.

Commands that arrive from a remote agent are no longer eligible for sandboxed execution and no longer auto-approvable by the permission classifier, so they run unsandboxed and wait for a human answer.

Reported per-request cost now multiplies the token-derived subtotal by 1.1 when the API says the request was served in the US region, and by 1 otherwise. The web search fee is added afterwards and is not multiplied. Dollar figures in cost and usage reporting will be higher for US-region traffic than in previous builds.

Operations that were blocked outright just because the session ran inside a Cowork frame, on the grounds that no approval card could be shown or answered there, now follow the ordinary approval path. That means the automatic permission classifier can approve them, instead of each one dead-ending on a human approval surface the session could not display.

When a permission request comes from a remote agent, Claude Code will not offer to remember the decision. The always-allow option is suppressed and the usual rule suggestions are hidden, the same way they are for requests capped by an organisation policy. Approvals from remote agents are one-time only.

Watching a published page for republishes and comments now has three states rather than on or off. In a remote session it is "durable": the artifact service holds the subscription and wakes the session for republishes and comments addressed to Claude. The old text telling the model that watching is not supported from a remote session is gone.

The instructions given to a worker agent in a multi-agent run now cover the whole finish: run the code-review skill, run the project's tests, follow the coordinator's end-to-end recipe, commit and push, open a pull request with gh pr create, then close with one PR: <url> line, or PR: none and a reason. It replaced earlier guidance about artifact fidelity in the same slot.

When a cloud session's files replace local ones, any file with uncommitted changes is copied into a .claude-cloud-trash directory before being overwritten, and you are told where the copies are. If no copy could be kept, the message says so plainly rather than staying quiet.

The previous build had only the message shape for registering device hooks; this one adds the working half, letting a cloud session register hooks that run on your device. Nothing forwards in practice: it requires two account flags that both default to off, and setting CLAUDE_CODE_DISABLE_HOOK_FORWARDING refuses it outright.

A complete path exists for a Remote Control session to arrive carrying MCP server config and extra CLI arguments, have the daemon write them to a locked-down temp directory and pass them to the worker process. Every call into it sits behind a check whose body returns false, so on this build no session config is ever built and neither new environment variable is ever set.

The Workflow tool has gained an entire second mode driven by a runId input: extra input fields, an extra result status, a v2 script description, its own consent prompt, custom result rendering and a background-task handle that pause and stop can kill. Every one of those paths goes through a single accessor whose whole body returns undefined, so none of it is reachable. Passing a runId today is rejected with "runId is not a field of this tool here.", and the permission prompt always falls back to "Review dynamic workflow before running".

Task notifications delivered over the SDK protocol accept a third kind, projects-relay, for deliveries composed by Anthropic servers for a Claude Code Projects coordinator session and addressed to a thread session. A delivery carrying the relay stamps is framed as a message from the coordinator session; one without them keeps the generic background-notification framing.

The agent listing now opens with the name other sessions use to address this session, with different wording when a subagent is asking, and adds a teammates section built from the team roster file.

Setting this environment variable now decides which engine syncs your directory to a cloud session worker, and the worker logs that the switch is on when it takes effect. Without it, the previous engine selection applies unchanged.

The worktree block in settings takes an optional location path saying where Claude Code Desktop should create worktrees for SSH sessions on this machine, instead of the default <project>/.claude/worktrees. Only the desktop app reads it; the setting's own description states that the CLI does not.

An experiment replaces the system prompt's opening line, in both the standard and the lean variant, with "You are an agent working with the user toward their goals, using your own judgment along the way." in place of "You are an interactive agent that helps users with software engineering tasks." It is controlled by the CLAUDE_CODE_INTRO_FRAME environment variable, and otherwise by a server-side flag named tengu_ochre_wren that falls back to off.

The Artifact tool, which publishes a local file to a shareable web page, can now pull a published page's content back into the conversation with a read action available to anyone holding the tool. Artifacts you own return raw HTML, while a page shared with you returns an isolated summary steered by an optional prompt. Alongside that, per-file browsing, multi-file publishing and deletion are fully built in this release but none of them are switched on by the build itself: each waits on a remotely controlled feature flag or an environment variable that falls back to off.

Directory sync, the mechanism that keeps a working directory tracked as it moves, normally anchors paths so it can follow a directory even if it is renamed. Setting CLAUDE_CODE_DIR_SYNC_DISABLE_ANCHORING turns that off and falls back to resolving paths by name, and the same release adds seven Claude-managed directory-sync variables to the set that is removed from the environment handed to child processes, so they do not leak into tools and subprocesses Claude Code spawns. Two of those seven names are reserved but do nothing yet.

On Linux, MCP server processes and up to 256 of their discovered child processes can be attached to a dedicated mcp control group so their memory is accounted separately from Claude Code's. Off unless the tengu_mcp_memory_cgroup flag is on (its fallback is false); CLAUDE_CODE_MCP_MEMORY_CGROUP forces it on, and a falsy value or none disables it.

When the agentPushNotifEnabled setting is on, an extra line is added to the prompt asking Claude to send a one-line outcome before it stops, on the grounds that you may be away and waiting to hear it is done, unless you just told it to stop. The setting falls back to false, so the line is absent by default.

Startup computes two decisions about whether this process may forward plugins and hooks to a device. Both admit only for a managed cloud worker, and two new environment variables, CLAUDE_CODE_DISABLE_PLUGIN_FORWARDING and CLAUDE_CODE_DISABLE_HOOK_FORWARDING, each force a refusal.

A silent turn reminder and a new note telling Claude who will read Bash output now resolve the same way: an environment variable wins, then whatever the model catalog declares, then a cached blob of settings the server delivers. Anything else is off. In practice both are off unless the server enables them or you set CLAUDE_CODE_SILENT_TURN_REMINDER or CLAUDE_CODE_BASH_OUTPUT_AUDIENCE_NOTE yourself.

The description Claude reads when listing the agents it can message now includes the teammates on your team. A separate prompt fragment tells Claude that a scheduled routine's notification is how the run reaches its owner, with the first sentence used as the phone banner and the full text as the email body.

The two flags that could switch off durable wake subscriptions, the mechanism that lets a session be woken later, are removed and no longer read anywhere; the feature is now always on. The failure message that blamed the flag is gone, and the "already holding" note now mentions restored subscriptions.

Before running git inside a synced directory, Claude Code reads the repository layout and checks it against the filesystem, pins off filter programs and hooks, restricts which protocols git may use, and disables lazy fetch, replace refs and grafts. Git is refused outright if a config file inside the working tree contributes settings, or if the git directory is not where git says it should be. Outcomes are recorded as telemetry.

The skill that tells Claude what a published page can do for each viewer now lists remembering what people do on the page (a poll, a sign-up sheet, a checklist, a document edited in place), knowing who is viewing, asking Claude a question of its own, and storing files people add. The same list went into the static-page template guidance.

When a coordinator session forwards a message to a worker agent, the message is now wrapped in a preamble that says whether the text is a copied user message or the coordinator speaking, and the body is escaped so a message cannot fake relay markup.

A session running as a Remote Control bridge child now drops dynamically supplied MCP servers unless the entry is the Remote Control meta server, and rebuilds even that one from the approved startup address and session id instead of trusting the file. There is no flag: this applies whenever the process is a bridge carrier child.

Two new messages cover an ultraplan that runs remotely: one tells you to monitor progress in Claude Code on the web and that you can keep working meanwhile, the other says results are ready and to press a key to view them.

The status a subagent reports back to the session that launched it now includes blocked, alongside completed, failed and killed, so a task that is stuck waiting on something can say so instead of being forced to claim success or failure.

When a cloud agent relays a tool call to your local Claude Code, the request is now marked as remote execution and evaluated more strictly. Your hooks do not run, and a locally relaxed permission mode is not inherited: acceptEdits and bypassPermissions are rewritten to default before the permission check.

Any settings layer can set modelSettings.<model>.effortLevel, which overrides the top-level effortLevel for that one model, with model ids normalised before lookup. Saving effort to user settings writes both the top-level key and the per-model entry. The lookup is gated on tengu_russet_plover, which falls back to false, so absent a server value the per-model table stays empty and effort behaves exactly as before.

The session's thinking effort stopped being a plain string. It is now a tagged value that can say "inherit", "default", or a specific level, and the settings side is a table with a default plus per-model entries resolved against the model the main loop is running.

Publishing an artifact now has a matching delete action. The tool result reports either "Artifact deleted" or "Artifact was already deleted", and if the model later encounters a deleted artifact URL it is told the link is dead, cannot be restored, and that republishing the same file produces a new URL.

A Bedrock streaming response that arrives with no content-type header at all is now treated as application/vnd.amazon.eventstream instead of being rejected. Set CLAUDE_CODE_DISABLE_BEDROCK_CONTENT_TYPE_DEFAULT to turn the defaulting off and get the old strict behaviour.

The list of artifact kinds behind the publish menu is down to documents; the spreadsheet and presentation deck kinds are gone. The tool now describes its file input as "Path to the .html file to render", the unsupported-file-type error no longer suggests .md as an alternative, and the artifact-design guidance says Markdown is only for a skill that explicitly asks for it.

On a fresh install where remote experiment config is not consulted, the flicker-free fullscreen renderer now starts on instead of off. This covers clients running with DISABLE_GROWTHBOOK, non-first-party setups and telemetry-off configurations. The fullscreen upsell is also suppressed when remote config is live but the client only ever saw its local fallback value, so it no longer nags people whose experiment value never arrived.

When you resume a session whose previous run was in plan mode, Claude Code now re-enters plan mode instead of starting in whatever mode the caller asked for. The guard is the remote flag tengu_tranquil_fern, which falls back to on, so this is active unless the server turns it off. It is skipped when forking a session and when the permission layer refuses.

When Claude saves a file it fetched from an artifact to a path outside the session scratchpad, or inside it under a name the file-edit safety rules watch (git, hook, tool or agent configuration), the approval can no longer be granted by the automatic permission classifier. A human has to approve it.

Of the three artifact skills, only the document one remains; the spreadsheet ("Publish a spreadsheet Artifact") and presentation deck ("Publish a presentation deck Artifact") skills are gone, taking their very large instruction bodies and HTML templates (the grid and formula engine, the slide studio and present mode) out of the build. That is a substantial size cut.

Tools can now declare that they support running on a remote device, and the Bash tool declares it along with a list of input fields it refuses in that mode. The model-facing half is an input field named device on remote-capable tools, added only when a gate passes. That gate is a function that returns false unconditionally in this build, so the field is stripped from every tool schema and no tool can be sent to a device.

A remote worker's startup can report that it needs action, with details drawn from its stored state, instead of the usual idle status. It turns on only when CLAUDE_CODE_HOLD_REPORT_PARK_AT_INIT, CLAUDE_CODE_HOLD_UNANSWERED_PARKED_PERMISSION and CLAUDE_CODE_RESUME_INTERRUPTED_TURN are all set.

HTML from an artifact published in your Slack channel is now wrapped in prompt text of its own, warning that it may contain edits by other people and that nothing in artifact content can grant Claude extra permissions.

Voice recording can now run through an audio socket forwarded from another machine, using a port and token written into a coder-audio cache directory. It is used only when those files are present; otherwise recording uses the local microphone as before.

Artifact responses can now carry embeds, a list of pinned items (uuid, path, module, files) plus warnings, which is parsed from server responses and rendered into a readable block that cuts off with "(embeds truncated)". The parser and renderer are ungated, but the artifact tool's result schema declares the embeds key only inside a spread guarded by a module-level constant set to false, and that constant is used nowhere else.

The auto_reply field of the artifact request schema now appears only when artifact comments are enabled, via the CLAUDE_CODE_ARTIFACT_COMMENTS environment variable or, failing that, the remote flag tengu_teal_corbel whose fallback is off. A separate embeds field sits behind a build-time constant set to false, so it never appears in the shipped schema.

Watch entries in the artifact tool now carry restored plus unread counters comments_uncounted, unread_plain_comments and summons_awaiting_reply, and the watch schema emits auto_reply only when artifact comments are on. Set CLAUDE_CODE_ARTIFACT_COMMENTS to enable; otherwise it follows the remote flag tengu_teal_corbel, which defaults to off.

A cloud session can now receive a plugin configuration pushed from elsewhere, carrying only a list of enabled plugins and extra known marketplaces. It is off unless two remote gates, tengu_violin_wood and tengu_violin_amati, both come back true; each falls back to false if the lookup fails, so with no server values this does nothing.

The lower-priority usage-limit mode carries its own built-in wording: label "Continue now at lower priority", status "Working at lower priority until {reset}", wait banner "Working at lower priority · waiting for capacity", and "You've used this week's lower-priority allowance". A confirmation is assembled at runtime around "Continuing now at lower priority" and ". Your weekly limit still applies, and responses may pause while waiting for spare capacity. Run /low-priority to stop." Every string can be replaced by the server config, and the whole thing stays off unless that config sets enabled to true.

Setting CLAUDE_CODE_POLL_EVENTS on its own no longer puts a session into poll-event delivery. A third condition was added: the launch options must record that event ingress was wired, a one-way latch set only from the SDK and streaming-input entry path.

When publishing an artifact hits a conflict, the client can automatically read the current live version and hand it back inline or as a saved file, and reports a specific reason when it will not. Read-only collaborators now get told plainly to publish as a new artifact instead. The whole path sits behind a helper whose default this build does not settle; when it is off, the guard records the reason gate_off and does nothing.

The workflow tool now recognises a second input shape carrying a run id plus one of put, retract or read. For those requests, permission checking skips the usual lookup of allow and deny rules by workflow name.

Stored artifact metadata now carries a co-written marker and an optional title, read back alongside the existing mode, shared-live and probe-failure fields. It is stamped only when the code writing the artifact asks for it, and there is no user-facing switch.

The input used to decide permissions and model routing now carries the session's proactivity level alongside whether plan mode is required, the permission mode and the session effort setting.

The shared HTTP client gains postRelayOnly and getRelayOnly, which send a request via the relay rather than going out directly. Opt-in per call site.

Requests to the messages endpoint can carry a new header, anthropic-usage-limit: slow, set when an internal usage-limit phase reports as active. The build also recognises a matching response header naming when a slow budget resets. The previous build had neither, only an "extended" value.

When Claude Code is started by a scheduled routine on Anthropic's side, the notification tool now gets extra instructions: wrap the message in <routine_summary> tags so the first sentence becomes the phone banner and the full text becomes the email body. Ordinary interactive sessions never see this appendix.

Permission-mode telemetry now carries an ultraplan flag, and session state sent into Claude Code is parsed for the same flag, so ultraplan survives a state round trip.

The plugin listing is now organised into scoped sections, one of which lists plugins synced from your claude.ai account and notes when sync is switched off in the current shell.

A managed setting can now refuse MCP servers pushed in from outside your own config. When disableSideloadFlags is set, the CLI warns that --mcp-config is forbidden on the machine and drops server-delivered MCP servers with a stated reason instead of loading them.

Managed policy settings gain a dir_sync_folder_ignore key, a newline-separated list of folders to leave out of directory sync.

CLAUDE_CODE_PARKED_STOP_RETIRES joins CLAUDE_CODE_RETIRE_UNANSWERED_PARKED_PERMISSION and CLAUDE_CODE_HOLD_UNANSWERED_PARKED_PERMISSION in deciding the fate of a permission prompt that was set aside and never answered. Unset by default, so nothing changes unless you opt in.

Seven more environment variables are preserved when Claude Code starts a remote or worker process, so settings you export locally now apply there too.

Artifact syntax highlighting and mermaid diagram rendering are now always on, their gates deleted. Three other gates were renamed, and all three still default to false, so what they guard stays off unless the server says otherwise and any remote config keyed to the old names no longer applies.

The artifacts dialog now shows a delete key hint, but only for artifacts you own and only when the session is not a remote one. Deleting keeps the panel open while the request is in flight and blocks Enter, rename, pin and refresh until it finishes.

Argument scanning now knows which flags take one value and which take a list, so options like --tools, --mcp-config, --betas, --channels, --plugin-dir and --file no longer swallow or lose their arguments. It also handles -- when locating the first positional argument.

Fenced code blocks tagged mermaid are turned into rendered diagram blocks wherever Claude Code emits formatted output, such as artifacts and pull request bodies. Rendering used to depend on a runtime probe for diagram support, which could silently leave diagrams as plain code; that probe is gone and the language tag on the fence is now the only condition checked.

The prompt input gained a second set of word motions modelled on readline: forward and backward word movement, kill-word and backward-kill-word, wired to Meta-Backspace, Meta-d and Ctrl-D, with killed text pushed onto a kill ring rather than simply deleted. The older word-motion behaviour is still present for the other mode.

Startup checked whether -p appeared anywhere in the command line, so passing it as somebody's argument value could silently switch Claude Code into print mode. It now only looks at real flags, and the same fix applies to the scan for cc:// and cc+unix:// URLs.

Claude Code now notices when the directory it is running from has been deleted or renamed instead of failing with an opaque error. At startup it stops and tells you plainly what happened, and once running, hooks that would have executed in the missing directory fall back to a directory that still exists and carry on.

When an MCP server offers tools whose input schemas are malformed, you now get a line saying how many tools were excluded, instead of those tools quietly not appearing.

Agent, command, skill and CLAUDE.md-style files saved with a UTF-8 byte-order mark had their YAML frontmatter treated as ordinary body text. All three frontmatter parsers now strip the mark first.

When a command's output passes the 10 MiB accumulation cap, the result is now flagged as truncated rather than silently losing the excess, and one more form of buffer-overflow error is recognised as such.

The rate-limit banner and the spend-limit notice now name the limit that was hit and when it resets, for example You've hit your monthly spend limit \xB7 your ${m9h.limitName} resets ${m9h.resetTime}. When no limit detail is available they fall back to the previous flat sentence.

New machinery creates a private directory under Claude Code's temp root and prepends it to PATH, and optionally PYTHONPATH, for every Bash tool call via a prologue spliced into the command string. The bash command builder already calls it. It is inert: the function the runtime consults returns nothing unconditionally, as does the provider of the directory's contents, so no prologue is ever added.

The dialog dispatcher used by the SDK gained a third branch for a Slack Connect consent dialog, alongside the two existing dialog kinds. The value the branch compares against is set to null and never assigned anywhere in the build, so the branch can never be taken.

A new helper appends a collaboration note to the artifact instructions, gated on a live-document module reporting that its streaming gate is open. That module is set to null in this build, so the gate is always false and the note never appears.

The MCP client can now accept a task result from a server, but only when the individual request opts in, the server advertised the tasks extension, and the payload validates. Nothing in this build sets that opt-in, so every task result currently ends in an unsupported-result-type rejection.

Code exists for a remote bridge session to install MCP servers handed over by the server during its opening handshake, and to swap them later over the control channel. Every part of it is inert in this build, so no bridge session gains servers this way.

Tools that declare support for running on a remote device have the device parameter stripped out of the schema the model sees whenever an availability check fails, and that check bottoms out in a helper returning false unconditionally here. So no tool currently offers device to the model.

Every tool now carries a remote-execution descriptor, defaulting to unsupported. Bash declares support and names three inputs it refuses when running remotely: dangerouslyDisableSandbox, run_in_background and _simulatedSedEdit. No user-facing flag turns any of this on, and the schema extension Bash spreads in returns an empty object, so no new options actually ship.

The path that starts an async agent now announces it on the same internal channel the Agent tool already used, carrying the agent id, agent type, parent agent id and task registry. Nothing subscribes to that channel anywhere in the build, so the two emits go nowhere.

The command description now reads "List subagents, teammates, and other Claude sessions you can message", matching the team-agent work elsewhere in this release. The command itself remains behind its existing availability check.

synced joins the list of reserved plugin marketplace names, which is now checked against one table rather than a chain of separate rules. New messages cover a claude.ai plugin losing to a same-named local plugin, and an attempt to modify a synced plugin. Fetching plugins from claude.ai still requires the CLAUDE_CODE_SYNC_PLUGINS environment variable, so with it unset the synced list is empty and none of the new messages appear.

When Claude Code decides a session is idle, it can print the running task list plus teammate and notification state. Off unless you set CLAUDE_CODE_BG_TASKS_REPORT_RUNNING.

A managed remote session that has an SDK URL now loads and starts a vitals emitter on demand, logging a warning if that load fails. A CLAUDE_CODE_DISABLE_VITALS_EMITTER variable exists to switch it off.

When the browser extension is not set up, Claude is told browser tools are unavailable, pointed at /chrome and the install surface, and told not to try the Chrome tools anyway.

claude plugin enable, disable, install, update and uninstall now refuse clearly instead of acting confusingly. Built-in plugins can only be enabled or disabled, never installed, updated or uninstalled, and a plugin locked by organization managed settings cannot be toggled for a --plugin-dir, skills directory or claude.ai-synced copy.

The /claude-api Python upgrade guide now reflects the released 1.0.0 SDK: it is built on httpx2, so anthropic.Timeout is an httpx2 timeout and a timeout object from the older httpx package is rejected when the request is made.

The copy-selection key binding now accepts the super key (reported as Cmd by some terminals) as well as ctrl, and no longer refuses the shortcut when shift is held.

Ctrl+Backspace now deletes the word before the cursor in the prompt editor, matching what Alt/Option+Backspace already did.

The prompt editor gained forward-word, backward-word, kill-word and backward-kill-word operations, and deleting to end of line now stores the removed text so it can be yanked back instead of being thrown away.

Clickable rows ignore clicks that land while the window is still coming to the front, or within a short settle period after the row appears, instead of acting on them.

The terminal input parser can now recognise a partial mouse sequence, wait briefly, and discard it if the rest never arrives, instead of letting the leftover characters land in your prompt.