{"version":"2.1.239","anchor":"artifact-tool-gains-a-read-action-with-multi-file-browsing-a","canonical_anchor":"artifact-tool-gains-a-read-action-with-multi-file-browsing-a","heading":"Artifact tool gains a read action, with multi-file browsing and delete built but gated off","tier":"use","area":"Artifacts","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.239\/e\/artifact-tool-gains-a-read-action-with-multi-file-browsing-a","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.239","markdown":"### Artifact tool gains a `read` action, with multi-file browsing and delete built but gated off\n\nClaude can now read back a published artifact's contents; browsing, multi-file publishing and deletion are built but off.\n\n**What**\n\nThe Artifact tool, which publishes a local file to a shareable web page, can now pull a published page's content back into the conversation with a `read` action available to anyone holding the tool. Artifacts you own return raw HTML, while a page shared with you returns an isolated summary steered by an optional `prompt`. Alongside that, per-file browsing, multi-file publishing and deletion are fully built in this release but none of them are switched on by the build itself: each waits on a remotely controlled feature flag or an environment variable that falls back to off.\n\n**Details**\n\n- The action list grew from `[\"publish\",\"list\"]` to `[\"publish\",\"list\",\"read\"]`; `list_files`, `read_file` and multi-file publishing are appended only when the remote flag `tengu_cobalt_plinth_bracken` is on, and `delete` only when `CLAUDE_CODE_ARTIFACT_DELETE` is set or the remote flag `tengu_cobalt_plinth_alder` is on.\n- Every one of those gates defaults to off, so a stock build exposes publish, list and read alone; because the flags are served remotely rather than compiled in, the build alone does not decide what a given session sees.\n- `delete` is forced off whenever the `CLAUDE_CODE_REMOTE` environment variable is set, regardless of its own gate.\n- With `tengu_cobalt_plinth_bracken` off, publishing extra files to one artifact is refused and the refusal is recorded internally as `multifile_flag_off`; the artifact-type variants that need several files and the guidance pointing the model at `list_files` and `read_file` are gated the same way.\n- Deleting is always possible from the terminal: `\/artifacts` lists the ones you own and `d` deletes the selected one.\n- Every delete asks you to confirm, the link stops working for everyone, and it cannot be undone; if the permission check fails before that prompt appears, nothing is deleted and you are told to retry after the underlying failure clears.\n- `read`, `list_files` and `read_page_data` are marked read-only and safe to run concurrently; `read_decisions` was removed from those lists.\n- `read_file` saves into that artifact's folder in your scratchpad by default, which needs no approval and which you can read back; any other `out_dir` asks you before each save, network paths are refused, and paths shaped like git, hook or agent config files are screened even inside the scratchpad.\n- Publishing narrowed so that an artifact's page must be `.html`, where the previous wording also allowed `.md`; a `.md` sibling now produces guidance to author HTML instead.\n- WebFetch no longer handles artifact URLs itself and instead points the model at these actions, and the design skill tells Claude to use `action: \"read\"`, falling back to WebFetch only where the tool is absent.\n- Artifact reads go through the normal permission rules keyed by host, so a deny or ask rule can block one, and prompts, deny messages and safety reasons were reworded to distinguish published files from the asset store.\n\n**Evidence**\n\n`A published file saved outside the session scratchpad carve-out requires a live human consent surface in this session`, `no files listed`, `Permanently delete a published Artifact the user owns (irreversible); every delete asks the user.`, `read_bad_url`, ` 'delete' permanently deletes an Artifact the user owns (pass its `url`; nothing else may accompany it) \u2014 the user is asked to confirm every time, the link stops working for everyone, and it cannot be undone.`, `read only: what to extract from an artifact shared with the user \u2014 its content reaches you as an isolated summary answering this. Ignored for artifacts the user owns and for a page published in this session's own Slack channel (raw content is returned); optional.`, `read_file: directory to save under \u2014 default: this artifact\u2019s folder in your scratchpad directory, where saving needs no approval and which you can Read from; any other directory asks the user before each save.`, `The permission check for this delete failed before the confirmation could be shown, so nothing was deleted. Retry after the underlying failure clears.`, `an Artifact's page must be .html`, `read_file: directory to save under \u2014 default: this artifact\u2019s folder in your scratchpad directory`, `multifile_flag_off`\n\n- Flag `tengu_cobalt_plinth_bracken`: Off in both readings (read for one account on one subscription tier against v2.1.239; this account: off, anonymous baseline: off, compiled default: off)\n- Flag `tengu_cobalt_plinth_alder`: Not enough to say (read for one account on one subscription tier against v2.1.239; this account: no value returned, anonymous baseline: no value returned, compiled default: off)\n- Area: Artifacts\n- Names: `CLAUDE_CODE_ARTIFACT_DELETE`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 4\/5\n- Present in the build but not switched on"}