Artifact tool gains a read action, with multi-file browsing and delete built but gated off / Claude Code v2.1.239

Use it now

Useful3 Signal4

Artifacts Notable not in their notes

Claude can now read back a published artifact's contents; browsing, multi-file publishing and deletion are built but off.

Per-file browsing, multi-file publish and delete are fully built but each waits on a remote flag or unset env var.

Feature flag

tengu_cobalt_plinth_bracken Off in both readings

The flag server returned off for the account this site reads and for the anonymous baseline. A reading of off cannot rule out a rollout these two readings sit outside of.

This account: off · anonymous baseline: off · compiled default in v2.1.239: on

tengu_cobalt_plinth_alder Not enough to say

Nothing here resolved what this flag was doing on this version, so nothing here should be read as on or off.

This account: no value returned · anonymous baseline: no value returned · compiled default in v2.1.239: on

Read once, for one account on one subscription tier, against v2.1.239. It isn't a statement about your account. What a flag value here can and cannot tell you

CLAUDE_CODE_ARTIFACT_DELETE

What

The Artifact tool, which publishes a local file to a shareable web page, can now pull a published page's content back into the conversation with a read action available to anyone holding the tool. Artifacts you own return raw HTML, while a page shared with you returns an isolated summary steered by an optional prompt. Alongside that, per-file browsing, multi-file publishing and deletion are fully built in this release but none of them are switched on by the build itself: each waits on a remotely controlled feature flag or an environment variable that falls back to off.

Details

The action list grew from ["publish","list"] to ["publish","list","read"]; list_files, read_file and multi-file publishing are appended only when the remote flag tengu_cobalt_plinth_bracken is on, and delete only when CLAUDE_CODE_ARTIFACT_DELETE is set or the remote flag tengu_cobalt_plinth_alder is on.
Every one of those gates defaults to off, so a stock build exposes publish, list and read alone; because the flags are served remotely rather than compiled in, the build alone does not decide what a given session sees.
delete is forced off whenever the CLAUDE_CODE_REMOTE environment variable is set, regardless of its own gate.
With tengu_cobalt_plinth_bracken off, publishing extra files to one artifact is refused and the refusal is recorded internally as multifile_flag_off; the artifact-type variants that need several files and the guidance pointing the model at list_files and read_file are gated the same way.
Deleting is always possible from the terminal: /artifacts lists the ones you own and d deletes the selected one.
Every delete asks you to confirm, the link stops working for everyone, and it cannot be undone; if the permission check fails before that prompt appears, nothing is deleted and you are told to retry after the underlying failure clears.
read, list_files and read_page_data are marked read-only and safe to run concurrently; read_decisions was removed from those lists.
read_file saves into that artifact's folder in your scratchpad by default, which needs no approval and which you can read back; any other out_dir asks you before each save, network paths are refused, and paths shaped like git, hook or agent config files are screened even inside the scratchpad.
Publishing narrowed so that an artifact's page must be .html, where the previous wording also allowed .md; a .md sibling now produces guidance to author HTML instead.
WebFetch no longer handles artifact URLs itself and instead points the model at these actions, and the design skill tells Claude to use action: "read", falling back to WebFetch only where the tool is absent.
Artifact reads go through the normal permission rules keyed by host, so a deny or ask rule can block one, and prompts, deny messages and safety reasons were reworded to distinguish published files from the asset store.

Evidence

A published file saved outside the session scratchpad carve-out requires a live human consent surface in this session, no files listed, Permanently delete a published Artifact the user owns (irreversible); every delete asks the user., read_bad_url, 'delete' permanently deletes an Artifact the user owns (pass its url; nothing else may accompany it) — the user is asked to confirm every time, the link stops working for everyone, and it cannot be undone., read only: what to extract from an artifact shared with the user — its content reaches you as an isolated summary answering this. Ignored for artifacts the user owns and for a page published in this session's own Slack channel (raw content is returned); optional., read_file: directory to save under — default: this artifact’s folder in your scratchpad directory, where saving needs no approval and which you can Read from; any other directory asks the user before each save., The permission check for this delete failed before the confirmation could be shown, so nothing was deleted. Retry after the underlying failure clears., an Artifact's page must be .html, read_file: directory to save under — default: this artifact’s folder in your scratchpad directory, multifile_flag_off

Strings lifted out of the shipped bundle, so the claim above can be checked against them.