Per-file browsing, multi-file publish and delete are fully built but each waits on a remote flag or unset env var.
The Artifact tool, which publishes a local file to a shareable web page, can now pull a published page's content back into the conversation with a read action available to anyone holding the tool. Artifacts you own return raw HTML, while a page shared with you returns an isolated summary steered by an optional prompt. Alongside that, per-file browsing, multi-file publishing and deletion are fully built in this release but none of them are switched on by the build itself: each waits on a remotely controlled feature flag or an environment variable that falls back to off.
- The action list grew from
["publish","list"]to["publish","list","read"];list_files,read_fileand multi-file publishing are appended only when the remote flagtengu_cobalt_plinth_brackenis on, anddeleteonly whenCLAUDE_CODE_ARTIFACT_DELETEis set or the remote flagtengu_cobalt_plinth_alderis on. - Every one of those gates defaults to off, so a stock build exposes publish, list and read alone; because the flags are served remotely rather than compiled in, the build alone does not decide what a given session sees.
deleteis forced off whenever theCLAUDE_CODE_REMOTEenvironment variable is set, regardless of its own gate.- With
tengu_cobalt_plinth_brackenoff, publishing extra files to one artifact is refused and the refusal is recorded internally asmultifile_flag_off; the artifact-type variants that need several files and the guidance pointing the model atlist_filesandread_fileare gated the same way. - Deleting is always possible from the terminal:
/artifactslists the ones you own andddeletes the selected one. - Every delete asks you to confirm, the link stops working for everyone, and it cannot be undone; if the permission check fails before that prompt appears, nothing is deleted and you are told to retry after the underlying failure clears.
read,list_filesandread_page_dataare marked read-only and safe to run concurrently;read_decisionswas removed from those lists.read_filesaves into that artifact's folder in your scratchpad by default, which needs no approval and which you can read back; any otherout_dirasks you before each save, network paths are refused, and paths shaped like git, hook or agent config files are screened even inside the scratchpad.- Publishing narrowed so that an artifact's page must be
.html, where the previous wording also allowed.md; a.mdsibling now produces guidance to author HTML instead. - WebFetch no longer handles artifact URLs itself and instead points the model at these actions, and the design skill tells Claude to use
action: "read", falling back to WebFetch only where the tool is absent. - Artifact reads go through the normal permission rules keyed by host, so a deny or ask rule can block one, and prompts, deny messages and safety reasons were reworded to distinguish published files from the asset store.
A published file saved outside the session scratchpad carve-out requires a live human consent surface in this session, no files listed, Permanently delete a published Artifact the user owns (irreversible); every delete asks the user., read_bad_url, 'delete' permanently deletes an Artifact the user owns (pass its url; nothing else may accompany it) — the user is asked to confirm every time, the link stops working for everyone, and it cannot be undone., read only: what to extract from an artifact shared with the user — its content reaches you as an isolated summary answering this. Ignored for artifacts the user owns and for a page published in this session's own Slack channel (raw content is returned); optional., read_file: directory to save under — default: this artifact’s folder in your scratchpad directory, where saving needs no approval and which you can Read from; any other directory asks the user before each save., The permission check for this delete failed before the confirmation could be shown, so nothing was deleted. Retry after the underlying failure clears., an Artifact's page must be .html, read_file: directory to save under — default: this artifact’s folder in your scratchpad directory, multifile_flag_off
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
tengu_cobalt_plinth_bracken Off in both readingsThe flag server returned off for the account this site reads and for the anonymous baseline. A reading of off cannot rule out a rollout these two readings sit outside of.
This account: off · anonymous baseline: off · compiled default in v2.1.239: off
tengu_cobalt_plinth_alder Not enough to sayNothing here resolved what this flag was doing on this version, so nothing here should be read as on or off.
This account: no value returned · anonymous baseline: no value returned · compiled default in v2.1.239: off
Read once, for one account on one subscription tier, against v2.1.239. It isn't a statement about your account. What a flag value here can and cannot tell you
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
A reading is one sample. Claude Code evaluates its flags remotely, so no client sees the targeting rule behind a value and this says nothing about your account.
New in this build: CLAUDE_CODE_ARTIFACT_DELETE