Claude Code v2.1.247

A new system-prompt section named willow_tern tells the model how its final message should read: lead with the answer, one idea per sentence of roughly 20 words, no em-dashes or parentheticals, keep code and numbers out of prose, and no headers under about 500 words. Set CLAUDE_CODE_WILLOW_TERN to any truthy value to force it on. Otherwise it needs a server-side decision, and the flag it falls back to is compiled off.

A new preview action on the artifact tool renders a local .html file in a headless browser at one or more viewport widths and in both light and dark themes, and returns screenshots plus a list of problems found by static checks. It asks permission first. Nothing is uploaded, though the page can still fetch any Google Fonts stylesheets it references.

The built-in context size for claude-sonnet-5 went from 967,000 to 1,000,000 tokens. The smaller 500,000 limits used for remote cowork and local agent runs are unchanged.

A new toggle that applies only to models advertising the opus_5_prompt_bundle capability. It reads CLAUDE_CODE_WILLOW_TERN first, then a boolean tengu_willow_tern key in client data, then the flag, whose compiled fallback is off.

A new Artifact action would take a file_path, wrap that single page the way publishing does, render it in a headless Chrome over loopback and hand back JPEG screenshots at each requested width in both light and dark, along with a mechanical list of layout problems, all without uploading anything. In this build the rendering module itself is absent, so the internal availability accessor throws and the action text is never added to the tool schema, leaving it unreachable no matter how it is configured. Only the descriptions and prompt guidance that would tell the model about it actually ship.

The MCP tool-call path gained a full implementation of long-running server tasks: registering or adopting a task, a background driver, a placeholder result while work continues, and a poller that reports progress as Task <id> .... None of it runs, because the check that decides whether to ask a server for a task is compiled to always return false and the request is sent with no task option set.

The permissions text used by auto mode now ships as an embedded file, and a new switch decides whether the rule telling Claude not to publish artifacts you did not ask for stays in that text. The environment variable CLAUDE_CODE_AUTO_MODE_ARTIFACT_CONSENT_RULE wins if set; otherwise a remote feature flag named tengu_umber_sluice decides, with a compiled-in fallback of off. The mapping is inverted, so off keeps the rule in the prompt and only a server value of on removes it, meaning the rule is on by default and the flag exists solely to turn it off remotely.

Before honouring a previously accepted answer about forwarding your hooks and plugins to a cloud session, Claude Code now checks whether the file holding that answer sits somewhere the session can write: the checkout, a synced directory, or a sandbox write inlet. If it does, or if that cannot be determined, the stored acceptance is refused as untrusted_store and you are asked to decide again interactively.

The built-in default for sending cloud session events flipped from off to on, so without a server value the CLI uses the v2 sessions API. The companion switch for v2 session create/read/update still defaults off, so only the event path moved. The live value still comes from remote config.

A cloud session that could itself rewrite your plugin configuration will not reuse the Yes you saved in /cloud-plugins. A new check works out where that saved answer is stored relative to everything the session can write to, and unless the answer sits outside all of it, the stored Yes is treated as unset. The session says so in plain text, names the reason, and asks you to run /cloud-plugins to decide for that session.

When a cloud session runs against a folder that also holds your Claude settings, it no longer loads your local plugins, and it tells you which folder is responsible: the one it was launched in, the one it syncs, another folder it may write to, or a location it could not resolve. The plugin choice itself lives in those settings, so a session with write access there could change it, which is why the location decides the outcome. Consent already given to share plugins is re-checked against that location and reset if the store turns out to sit somewhere the session can reach.

Forwarding this machine's hooks to a cloud session now goes through a fuller admission path that resolves each script's interpreter from its #! line, holds back scripts that read code or data out of the checkout, drops a shell prefix it cannot trust, and trims PATH entries it cannot resolve locally. Hooks whose program resolves somewhere the cloud session can write are refused at call time rather than served. The single generic notice about a hook not being pinnable is replaced by two that say which condition applied.

Plugins can define a Button element with a key, label and press handler, and pressing it fires a new ui.press event back to the plugin. The terminal renders it as a focusable [ label ] row reporting surface: "terminal", and the desktop app registers the press with surface: "desktop". None of it is reachable: it needs plugin hook modules to be loaded, which is gated by tengu_plugin_hooks_modules, and the value compiled into this build is false.

A new module builds a throwaway git directory under ~/.claude/seed-admin when a cloud session uploads your repo as a bundle, so the upload reads a scrubbed copy of HEAD, refs and the index rather than your working .git. It only runs when the bundle route is taken: set CCR_FORCE_BUNDLE or CCR_ENABLE_BUNDLE, or have the remote gate tengu_ccr_bundle_seed_enabled on. That gate has no compiled fallback at the call site, so off the env vars it is entirely the server's call.

A new check runs after a Write or Edit on a file in the memory directory and can hand Claude up to three kinds of feedback: a warning that the file is at or over the size that recall reads, a note that a name-2.md continuation file sits next to an existing name.md, and a complaint that the frontmatter description is missing or longer than 300 characters. It runs only in memory-directory mode plus a second per-path condition whose implementation is not present in the shipped bundle, so whether the lint path ever fires is decided elsewhere.

A Button element joins the plugin drawing vocabulary alongside Box, Text and span, written as <Button key label onPress> with both props required as strings and the label length capped. The terminal renders it as an interactive [ label ], and pressing one dispatches a new ui.press event through the owning plugin's chain, subject to a handler-budget timeout. Neither the event nor the element exists in 2.1.246. Whether plugin-drawn UI is reachable at all depends on the plugin render API's own gate, which is not resolved in this build.

Plugin hooks that see a prompt submission now receive two extra fields: origin, saying where the prompt came from, and wait, saying whether it queues behind the turn in progress. New rules reject any hook answer that invents an origin the engine did not set, changes the one it was given, or sets or changes wait. This whole surface exists only when the JavaScript plugin hooks rollout is enabled, and its in-build fallback is off.

A new status bar item can show Usage limit reached with the time it resets, or Usage limit reached · a little extra on us, then your credits when extra usage is being covered for you. It runs only when the server flag tengu_lantern_sconce returns true; the value compiled into this build is false, so nothing appears unless a server says otherwise.

The remote session manager can now accept work sent back from a cloud session and answer it locally. Incoming control requests of subtype remote_tool_call, remote_plumbing_call and remote_tools_probe are tracked as pending served requests, answered, and cancelled or retired when the session gives up.

Attach failures used to collapse into a generic "couldn't attach". Two causes are now separated. A session whose terminal host died is restarted on a fresh host, automatically on the command line and on the next Enter in the picker. A session that simply did not answer is offered a stop-and-attach cycle, with a note that the conversation is saved. Sessions you adopted from a shell command get different wording, because their command is not re-run for you.

The subcommand now emits a single JSON line describing whether the sandbox is enabled, where that setting came from, whether strict mode is on and what the filesystem policy is, alongside the Windows install state.

Hooks that run when you submit a prompt can now hand back a session title, which Claude Code applies to the current session, along with extra user or attachment messages that get folded into the turn.

Set ANTHROPIC_PROFILE to choose which stored credential profile is used when authenticating through workload identity federation. Without it, the previously active profile is used.

The Bash permission dialog now shows a tip saying auto mode handles these prompts for you and pointing at the "switch to auto mode" option below, offered only when the prompt is not already an explicit ask rule or driven by a hook. Accepting the auto-mode option is now reported under its own name rather than always as the workflow prompt, and accepting a normal option now passes the option you actually selected instead of a stale one.

Team and org memory sync now skips any memory file that is zero bytes instead of pushing it, so an accidentally emptied file on disk can no longer wipe the shared copy. When the pull side refills such a file, you get a notice explaining that an empty file is never synced over a memory's shared content, and that deleting the file is how you remove a memory.

When you hit a rate limit, Claude Code can now submit the hidden /rate-limit-options command for you instead of waiting for you to ask. It is keyed on the current reset time so it fires at most once per window, and is skipped in non-interactive runs and when notices are suppressed.

When you hit a usage limit and are given grace to finish what you are doing, Claude Code now tracks whether the grace belongs to the 5-hour or the 7-day window, when that window resets, and whether extra usage is allowed or allowed with a warning. The grace state clears itself once the window has passed instead of staying latched.

Hooks you configure for prompt submission are now run as part of the plugin prompt chain instead of standalone. Results are cached per input text and only committed once the chain settles, so a prompt rewritten upstream gets the hooks run over the final text rather than a discarded draft. Cancellation from the abort signal, or a hook cancelled without timing out, is now reported as a cancellation instead of a failure.

The chat prompt gained a second submit action that queues what you have typed rather than sending it right away. It ships bound by default as "ctrl+x enter": "chat:queueSubmit" and is available in the list of chat actions you can rebind. Nothing gates it, so it works for everyone on this build.

Claude Code now hard-denies all writes under ~/.claude/seed-admin, both for the model (a safety refusal that cannot be approved away) and in the sandbox, which lists the directory as unwritable alongside jobs and daemon. The only thing that fills it is the cloud-session upload path, reached from "Continue this session in the cloud" in the Teleport menu, which is behind tengu_teleport_send_to_cloud and compiles in as off. The guard rails are live for everyone; the feature they guard is not, absent a server value.

The Artifact tool schema accepts auto_open with values at_create and after_first_write, applying only to a create with type_url and no file_path. It is spliced into the schema only when Artifact type creation is enabled for the account by server-side config, so with no server value the parameter is not offered at all.

The loop that auto-reacts to comments on an artifact now passes a thread transcript into every post it makes: the fast acknowledgement, the patch-failed or timed-out notice, the substantive reply and the edit path. The supplier that produces it returns an empty array in every case in this build, so no transcript actually reaches those posts. This is plumbing landed ahead of the data.

The control protocol between a cloud worker and an attached CLI gains four new requests: an announcement of the tools a machine offers, a call of one of them, a call of internal plumbing, and a liveness probe. An announcement carries up to 16 native tools and up to 256 passthrough MCP tools. This replaces an older tools-list announcement and is gated on an account flag, tengu_violin_wood, whose built-in fallback is off.

Restoring MCP task helper processes from a saved session now checks which protocol each one declared. Entries on the newer sep2663 protocol are skipped by the older restore path with a log saying they need the v2 runtime.

Tools hosted on another machine could previously only be reached over the device bridge or a local loopback, and a third route is added where the host announces itself over the session's own channel. Session-channel hosts are listed ahead of the other two and are dropped rather than kept as offline entries, but are otherwise handled identically to bridge hosts throughout the remote-tools code. The whole route is gated behind the account flag tengu_violin_wood, which is off unless an account's server-side config turns it on, and can be switched off locally with an environment variable.

New checks read the auth token's claims to tell whether it is acting as a bot or belongs to a service account, which have no user identity attached.

Feature handles attached to a cloud session are now told when a turn starts and ends, and can each register work that must finish before a message is sent.

The cloud worker client now reports every batch of durable session events as it moves through sending, accepted or failed, and maps the requests carried in a batch back to their callers so a request in a dropped batch is rejected with a delivery-specific error instead of staying pending forever. The reporting and drop handlers are optional arguments, and the only caller that supplies them gates them to sessions on your own compute, so an ordinary local or cloud session behaves exactly as before.

New code can delete a single record from a stored session by rewriting the stream in place, which is the machinery a targeted deletion would need.

The plugin sandbox protocol adds ui.press to its operation list and dispatch table, with the worker counting presses in flight and declining to go idle while any are outstanding. The layout map gives Button block display and the plugin JSX runtime defines h. The fs.ancestors file operation landed in the same change.

The list of behaviours the safety classifier can label now includes publishing an artifact the user never asked for, alongside existing entries such as unauthorized persistence.

Certain sensitive messages arriving over the session channel are judged against a device-attestation floor, and a message with no stamp is treated as refused. Below-floor requests are dropped without an answer, below-floor replies are dropped so the original request keeps waiting, and a below-floor settings change has only its forwarded-plugin key removed while the rest applies.

When Claude Code runs with CLAUDE_CODE_ENTRYPOINT set to local-agent, only three built-in skills are registered, and only if a further runtime check passes. The design canvas skill and the rest of the set a normal CLI session loads are skipped.

Deleting an artifact no longer talks to the frame client directly; it uses a relay-only DELETE route that recognises when the relay is unavailable or not serving this session, verifies that 404s and success statuses really came from the Artifact service rather than an intercepting proxy, and shows a refusal message in cloud sessions that cannot delete. Delete itself still requires the CLAUDE_CODE_ARTIFACT_DELETE environment variable or the flag tengu_cobalt_plinth_alder, whose fallback is off.

Creating an Artifact from a type can now pass auto_open: "after_first_write", which holds back opening it for you until content actually lands, so you no longer watch an empty page. The pending open is parked per Artifact and flushed by the first successful write, or consumed by a later publish of files. Validation rejects the value when there is nothing to wait for, such as a publish that is itself the first write.

A process can now start the debug logger with syncExitDrain: false, and when the v5 log storage backend is in use, queued lines still pending at exit are dropped instead of written. Startup prints a warning that the log may be truncated. Without an explicit false, the logger still drains as before.

Design errors now tell you that running /design login once from an interactive session on the same machine lets headless and SDK runs reuse that authorization, instead of only reporting that the command is unavailable.

Function hooks can call $.fs.ancestors, which walks from the project directory up to the filesystem root and gathers named memory files along the way. It returns an empty list when project memory is turned off.

A read can now pass dedupUnchangedReads: false to bypass the suppression of re-reads of unchanged files, alongside the existing exemption for remote calls. The kill-switch flag still compiles to off, so dedup remains on by default.

Administrators can now require gateway login from managed policy settings: it applies when forceLoginMethod is "gateway", or when forceLoginGatewayUrl is set and no method is named.

A new sandbox status path emits a JSON object stamped statusVersion: 2 covering whether sandboxing is available, installed, policy-locked and supported, whether it is enabled, whether strict mode is on, and the filesystem policy, with reasons attached.

Hooks run on your machine for a cloud session now get a composed environment rather than just a PATH. If CLAUDE_CODE_SHELL_PREFIX is set but is not an absolute path outside what the cloud session can write, it is left out of the hook's environment and you are warned that the hook ran unwrapped.

The hook-suppressing config described above defaults to on, and only tag pushes ask for it to be lifted so repository push hooks still run. Diffs now pass --ignore-submodules=none and --end-of-options, sparse checkout is forced off for some operations, and GIT_CONFIG was added to the git environment variables Claude Code clears.

The spinnerTipsOverride setting is now a full object rather than a list of strings, letting you supply tips inline or from a JSON file, replace the "Tip" prefix with your own label, and drop the tips that ship with Claude Code. Individual tips can carry an identifier, a per-tip cooldown and a priority weight so a curated set rotates the way you want. Parsing is lenient throughout, so a malformed field or entry is dropped rather than breaking settings loading, and what a scope is allowed to set depends on whether that scope is trusted.

In terminals using the kitty keyboard protocol, Ctrl combinations now resolve from the base-layout codepoint the terminal reports, so Ctrl+letter shortcuts work on Cyrillic, Greek and other alternate layouts instead of being dropped.

The switch controlling whether MCP servers that failed to connect are shown to you now defaults to on instead of off, so unless the server says otherwise you will see connection failures reported.

A prompt you type while Claude is still working is now run past your prompt-submit hooks the moment you press Enter, instead of only when the queue drains. If a hook rejects it, the prompt is dropped from the queue straight away and you see the hook's message, or Prompt dropped by a hook if it gave none. No flag guards this.

A queued command attached to the conversation now uses the submitted prompt text rather than the raw contents of the input box, so expansions and transformations reach the model in their final form. Applies both to plain prompts and to prompts with images.

When an MCP server announced that its resource list changed, Claude Code refreshed resources and skills but silently skipped commands, so that server's slash commands kept their old definitions until restart. Commands are now refetched along with everything else.

Setting the skills-sync veto, the account plugins sync toggle and the plugins-sync veto each stored into a different field than the one read back, so none of the three survived a round trip. The writes now land where the reads look.

The footer used to show an indicator only when configuration supplied one, capped at 32 characters and 6 lines. This build adds a fallback that prints the literal text rulz12 when no indicator is configured and a new per-render condition holds. That condition is computed from the current permission mode and the resolved main-loop model, and the function it calls is not identifiable in the shipped bundle, so whether it is ever true is not determinable from the build.

The protocol for tools on an attached machine describes two things this build cannot do. One is a plumbing call, a tool call made by the session's own machinery rather than by Claude, described as being only directory sync's file-sync tool today. The other is carrying the machine's own MCP tools in an announcement, which the schema itself says are carried but not yet served.

A new artifact-relay flag, compiled to off, is read by a single small function whose name was freed up by renaming the route-classifying helper that used to own it. No call to that function appears in the surrounding module, and the flag name occurs exactly once in the whole build.

Seven places that touch auto-memory, including the memory file watcher and the memory tool, now await a new warm-up call before resolving paths. Its body immediately resolves and nothing ever fills the canonical workspace root it is meant to prime, so path resolution still falls back to the existing git-root lookup.

The client that talks to the Remote Control worker can send requests through an injectable compressing fetch when one is supplied, falling back to plain fetch otherwise. It also gained a read of a worker's internal events scoped to one agent, and its retry helpers can now be cancelled.

Requests to the Remote Control worker can now be sent with gzip-compressed bodies. It is decided by the flag tengu_gentle_hammock, which is compiled in as off, and can be forced either way with CLAUDE_CODE_GZIP_CCR_REQUEST_BODIES. It only applies on the Bun runtime, and only for string bodies of at least 1024 characters.

Cloud sessions can defer loading subagent transcripts until they are needed. The switch checks the environment variable CLAUDE_CODE_CCR_LAZY_SUBAGENT_HYDRATE first, then a remote flag whose value compiled into this build is false, so nothing changes unless the server enables it.

The awsAuthRefresh setting, which runs a command to refresh AWS credentials, now takes either the old shell string or a structured {file, args, env} form that avoids a shell.

Opening a job in the fleet view a second time now offers to restart it, forcing through a session that has stopped responding and replying on resume if the job was still active. If the old process is still alive after the attempt, the offer is re-armed and the error is shown with a prompt to press Enter and try again.

When the user prompt you are reading responses to scrolls off the top of the transcript, a one-line truncated summary of it stays pinned at the top, and selecting it scrolls back to that message.

Pressing up to bring back an earlier prompt that began with ! or # used to be treated as if you had just typed that character, switching the input into bash or memory mode. The recalled entry's own stored mode is now applied instead.

Passing an unusable socket path used to be logged and ignored. It now fails with a user-facing error naming the flag, spelling out what was rejected: a remote or UNC path, or a pipe name with extra segments or a trailing dot or space.

If you pass a plain plugin name that matches both a built-in plugin and a different loaded plugin with the same name, the command now stops and tells you to disambiguate with plugin@marketplace instead of quietly picking one.

A rename that applied locally but failed to reach the shared record of running sessions now says so, and points you at --debug for the cause. It used to fail silently apart from an unrelated line about a PID file.