Claude Code v2.1.251

A collaborative sketch canvas joins the existing single-player whiteboard: everyone with the board open sees each other's strokes and cursors as they happen, and Claude can draw on it live. It supports boxes, databases, decision diamonds, sticky notes, arrows, freehand, text and pasted images.

A new tool works on comment threads left by viewers of a published artifact. It supports reading threads (paged by thread id and cursor), posting a reply, and marking a thread resolved. Resolving is refused entirely in plan mode, and reading comments after an unattended new-comments notification asks you to confirm even in channels that normally auto-allow.

A new tool lets Claude watch an artifact you published, stop watching, check watch status, and resume automatic replies to comments it had stopped making. The first time an artifact is watched, or whenever automatic replies would be turned on, it asks you to confirm.

When a first-party document connector is attached (a Google Docs-style integration the host itself designates as first-party), asking for a page, doc, notes, memo, plan or report now goes to that connector rather than producing an HTML artifact. You still get an artifact if you ask for one explicitly, ask for an HTML or Markdown file, or ask for something app, site, dashboard or game shaped.

Two hook events now fire around model changes. PreModelSwitch runs before a switch from /model, the model picker, the SDK or a resume, and can allow, deny or ask via permissionDecision (or block with exit code 2); deny cancels the switch and ask prompts for confirmation, except in headless sessions where it refuses. PostModelSwitch runs after the model changes and can inject additionalContext that reaches the model on the next request.

A mode that keeps the system prompt static and instead injects the environment snapshot, output-style guidance and language instructions as reminder blocks in the conversation. It is off unless CLAUDE_CODE_CARVED_SLATE is set; otherwise a remote flag decides, and that flag defaults to false.

A new subsystem opens a websocket to /api/frame/sync to track who is currently viewing an artifact, with owner and account verification, token refresh over the connection, reconnect and backoff, and its own telemetry. It is off by default: it turns on only if the remote config flag tengu_brass_plover is enabled or the environment variable CLAUDE_CODE_ARTIFACT_PRESENCE is set.

Running /model with a model name now consults any registered model-switch hooks before the model changes. A hook can block the switch outright, in which case you see "model switch blocked by a PreModelSwitch hook" and are told to run /model to confirm, or it can answer "ask", which leaves the model unchanged and directs you to /model interactively. Hooks can also attach their own messages to the confirmation, so a switch that needs a second look explains why instead of failing silently.

Choosing a model in the picker can now also set a per-session effort level and an "ultracode" flag, when the entry you pick carries a level. The switch runs through a hook-based confirmation that can block it or ask you to confirm first, and the picker no longer writes settings itself; the surrounding code does.

Claude Code can now suggest installing a marketplace plugin when it notices a file extension that a language server plugin would help with. Accepting installs the plugin; choosing "disable" sets a stored lspRecommendationDisabled setting that stops the suggestion for good. The prompt appears at most once per session, and dismissing it without choosing counts as cancelled.

Three new points where a plugin can intervene: whether a given subagent type is offered to the model, the text of a skill's prompt before it is used, and the attribution text attached to commits and PRs. Each runs only if a plugin registered a handler for it; otherwise Claude Code's own default behavior runs unchanged.

When a session starts by resuming or forking, the SessionStart hook payload now includes seconds_since_last_response, context_tokens, prompt_cache_likely_expired, and estimated_cache_write_usd. A hook can use these to judge whether the prompt cache has lapsed and what re-caching the context will cost before doing anything expensive.

The tool that proposes new skills used to require a server-side flag that defaulted off. That check is gone, so availability now rests entirely on the environment variables CLAUDE_CODE_SKILL_PROPOSALS and CLAUDE_CODE_SYNC_SKILLS.

After you approve an ultraplan in the browser, all three choices are now implemented: implement it in the current session, start a fresh session with it, or cancel.

A file-system watcher over the synced project root has been added, so changes reach a remote Claude Code session as they happen rather than only at explicit sync points. Bursts of edits are debounced: 750ms of quiet, at most 4s of waiting, and at least 2s between uploads.

Claude no longer treats a thread as fair game once anyone opens it in the artifact view. A writer has to hand the thread over, either by replying on it with "Send to Claude" or by mentioning @claude in it. Resolving a thread now also tells you which threads were not sent to Claude and how to send one.

New machinery watches memory read and write tool calls and the version stamps on their results. If a memory file the model read earlier has changed since, an update block is injected telling the model its earlier read is stale, with instructions never to quote or paraphrase that block back to you. Gated behind an internal flag that is off unless server config enables it, so nothing in this build turns it on.

A check now identifies models that cap reasoning effort when thinking is disabled, matching claude-opus-5 by name or any model whose capability list carries a thinking_disabled_effort_cap entry.

Plugins can play audio and can write files and resolve ancestor directories from a hook. Audio playback is refused for anything that is not a loaded plugin, and ancestor path resolution is guarded so a plugin cannot walk outside the project.

Outbound API requests can carry an anthropic-dispatch-id header selecting a newer routing path. Setting CLAUDE_CODE_DISPATCH_V2D (or the remote flag tengu_dreamy_frost) sends v2d; CLAUDE_CODE_DISPATCH_V2S (or tengu_cedar_lattice) sends v2s. With neither set no header goes out and the existing route is used. Both remote flags default off.

SendMessage now recognises targets that look like Claude Desktop session ids and delivers plain-text messages to them through Claude Desktop itself, alongside the existing local-socket and remote-bridge delivery paths.

A comment attached to a spot in an artifact now gets a short snippet of the page content at that spot, so Claude has context even when the comment does not quote any text. Enabled by the tengu_teal_corbel_finial flag, which defaults to on and can be turned off by remote config.

Consent to join an artifact's live room, previously only a yes or no you gave, can now be recorded as granted by the automatic permission classifier. That grant holds only while the session stays in auto permission mode, and a refusal or a manual stop you made earlier keeps the classifier from auto-joining that room again.

The document and report artifact skills now describe themselves as deferring to an attached first-party document connector, so requests for pages, docs, memos, plans, notes and reports use that connector's tools instead of building an artifact.

Approving a join of an artifact page's live room now shows a disclosure: while the room is open, page events from anyone in your organization who has that page open can arrive as notifications and start turns without you present. It stops when the room is stopped, when you leave auto mode, or when the conversation or session ends.

The room_send action, which broadcasts a live, non-persisted event to everyone currently viewing a published artifact, cannot be auto-approved under any configuration. It is refused in plan mode, refused in a Cowork session with no way to show an approval card, and otherwise raised as an ask prompt that no always-allow rule can satisfy.

What was already a rejected-switch telemetry path is now fed by a hook-style decision taken before the switch lands: anything other than proceed rejects it with an error, and a rejected system-prompt switch reports separately. Notices from the decision come back with a successful switch.

The pull-request workflow instructions now tell Claude Code, after creating or updating a PR, to look in your CLAUDE.md for any mention of posting to Slack channels, search for a Slack tool, and offer to post the PR URL. If no Slack tool is available it moves on without saying anything.

Watching an artifact reports differently depending on session type. A remote session holds a subscription on the artifact service that outlives the session and wakes the session with a new turn when the artifact is republished or a comment is sent to Claude, with no live updates streamed. Local sessions keep the live connection and its streaming updates. The choice is automatic.

When a leader approves or denies a tool call on a teammate's behalf, the request now carries the tool name and a digest of the tool input, and the reply is classified as bound, unbound, a tool mismatch, or an input mismatch before it is applied. This stops an approval landing on a different tool call than the one it was given for.

A follow-up message on a thread can be handed directly to an artifact editor sub-agent that is still working, instead of going back through the coordinator first. It requires the environment variable CLAUDE_CODE_EDITOR_CODELIVERY to be set to a truthy value and the session to be a relayed human conversation; otherwise the path is skipped entirely.

A session running in a "confined" mode now refuses permission grants that arrive through a tool or plan response, logging them instead of applying them. Such a session can only be granted permissions by the flags it was started with.

The CLI now advertises dedicated subcommands for background sessions: attach, logs, stop (alias kill), respawn with --all, and rm.

Publishing an artifact can now carry your own thumbnail images, one for light and one for dark. They must be PNG or JPG and under a size cap, and if the server refuses the custom image the publish is retried automatically with the auto-generated screenshot and a warning.

CLAUDE_CODE_DISABLE_MCP_TASK_BACKGROUND joins the recognised CLAUDE_CODE_DISABLE_* toggles. Backgrounding of MCP tasks is on unless you set it, so this is the opt-out for people who want those tasks to run in the foreground.

Whether the Bash tool's system prompt carries the Git safety and commit instructions now goes through one explicit check that honours the CLAUDE_CODE_DISABLE_GIT_INSTRUCTIONS environment variable and an includeGitInstructions setting. The default is unchanged: the instructions are included.

When a Task worker is launched without an explicit model, it now falls back to a configured default subagent model if one is set, and only then to the model of the session that spawned it. An agent definition's own model setting still wins over both.

If your organization's managed settings disable auto mode for the kind of session you are in, Claude Code now leaves auto mode during its normal permission refresh and posts a notice in the conversation pointing at settings, rather than staying in a mode policy forbids.

The check that decides whether a value looks like a secret, used to redact environment variables before they are recorded, now recognizes common token prefixes including ghp_-style GitHub tokens, github_pat_, glpat-, Slack xox tokens, sk-, pk-, AKIA, JWTs starting eyJ, ya29. and npm_, plus any string of 20 characters or more mixing letters and digits. It replaces a much narrower earlier scheme.

The pattern used to strip credentials out of output and logs was rewritten from a narrow check into one that matches many assignment shapes: passwords, tokens, API keys, JWTs and similar. Fewer secrets leak into what you or the model see.

Before asking you to approve a sandboxed network connection, Claude Code checks whether the hostname changes when run through its confusable-character normalizer, which catches homograph and IDN spoofing. If it does, the prompt is not shown at all, so a look-alike host can never be approved by mistake.

Each turn's status and debug payload now includes a prompt-cache block, and there is a one-line summary of the main conversation's cache: whether it is warm, how many requests and misses there have been, the hit ratio, and how many rebuilds are expected.

The prompt asking whether to allow a network connection out of the sandbox now shows which source made the request and tracks a per-host connection budget. Once the request is superseded, the option list is disabled so a stale prompt cannot be answered.

Accounts on a gateway plan now see a spend limit line with the percentage used and when it resets, both inline and as a "Spend limit" panel in settings. Before the gateway reports any usage, the panel shows "Spend limit · shown once your gateway reports one". Other plan types see nothing.

Launching a subagent no longer asks for confirmation when the agent type is active and every URL mentioned in its prompt would already be allowed by the WebFetch permission rules. If any URL is not already permitted, or the prompt carries too many of them, you get the usual permission prompt.

Both tools now hold an open handle, read the current contents and re-check them immediately before the write lands, narrowing the window in which a file could change between being read and being overwritten.

When a write is applied with a recorded content hash, Claude Code now re-hashes the file on disk first and refuses the write if the contents no longer match, so an edit you approved cannot silently clobber a change made in the meantime.

The main prompt input component now receives a flag for whether a "proactivity" menu is open, alongside the existing help overlay and mode state. Nothing in this build shows what opens that menu.

When the destination is a first-party document connector that renders live charts, the data-visualization skill now tells Claude to hand over the underlying data rows, inline or as an uploaded data file the chart cites, instead of a rendered PNG or SVG.

The sandbox configuration builder gained a mode that suppresses most filesystem grants, leaving a policy-only sandbox. Nothing in the code read for this build shows what turns the mode on.

The agent offer hook has a formal event definition sitting alongside the existing tool call event, matched on the agent, its description and where it came from, and answered with a single offered boolean.

Publishing a plain page can now scan it for declared thumbnail tags and attach a light and a dark thumbnail alongside the page. The whole path sits behind the remote config flag tengu_cobalt_plinth_campion, which defaults to false in this build, so no publish attaches thumbnails unless the server turns it on.

A dialog exists that summarises what would be left behind if you back out of a session: carried-over items, parked monitors, and workflow agents that are running, finished or queued to rerun. It offers confirm, stay or cancel. Nothing in this part of the build shows what triggers it.

New logic tracks main-loop request timing, when you last typed, and any delegated or background work in order to compute how long a session has been idle, then logs what a cache stop would have done. It does not act on that decision in this build, and the whole thing is behind an internal flag that defaults off.

The check controlling the in-product permissions path for Claude for Chrome used to consult a server-side flag. It now returns false outright, so the path cannot be reached in this build no matter what the server sends.

A setting decides whether reasoning text produced by a non-Claude model survives an upgrade to a different model instead of being discarded. It is off unless the tengu_luminous_whistle experiment turns it on, and CLAUDE_CODE_LUMINOUS_WHISTLE overrides either way. Even then it only applies when a separate precondition holds.

New code starts fetching memory context for the current host as soon as a query begins and joins the result later, recording how long the fetch took and how much of it overlapped with the start of the turn. It sits behind the same off-by-default memory flag as the stale-read warnings.

A new path looks up a text snippet keyed by the model in use and, when one exists, applies it as extra session content, recording an event with its length and effort level. Nothing in this build supplies such a snippet locally, so it stays inert unless a server-side entry is populated.

Artifact operations covering comments, subscriptions, listing types and creating a type are now each mapped to one of two remote flags, tengu_cobalt_plinth_burnet and tengu_cobalt_plinth_mallow, so they can be turned on individually from the server.

The system that injects short notes into the transcript gained kinds for environment, model, output style instructions, session context, date and language changes. All sit behind one feature check and emit a note only when the change parses cleanly, so nothing appears unless that check passes.

Every availability check for the cross-session remote-control bridge reads the same tengu_ccr_bridge gate, whose built-in fallback is false, so the bridge stays off unless the server turns the gate on. Its resolved value now appears in the CLI's internal debug output next to the rest of the feature-flag state.

The SDK's query layer now handles a control request that asks the host to refresh the credential a background session uses when driven by remote control, and there is a matching caller that sends it end to end. It is complete rather than a stub, but only works if the SDK host supplies the refresh callback; otherwise the request throws "refreshWorkSecret callback is not provided."

The registry that tracks long-lived sessions gained a way to subscribe to a session's state, polling and emitting normalized values such as an armed state naming the engine and direction, or an off state naming the reason. It also counts when a session's full listing grows past its allowed size. Nothing user-visible consumes it yet; it looks like plumbing for a status indicator.

The multiplayer canvas is a separate skill registration sitting next to the existing single-player whiteboard, with its own on/off condition rather than sharing the old one.

Alongside the request header, the code picks between two internal dispatch implementations using the same controls: CLAUDE_CODE_DISPATCH_V2D and CLAUDE_CODE_DISPATCH_V2S, falling back to the remote flags tengu_dreamy_frost and tengu_cedar_lattice, both defaulting to off.

A new environment variable, CLAUDE_CODE_EVAL_CONFINED, appears 26 times in this build and not at all in the previous one. Claude Code sets it to 1 on subprocesses it spawns for evaluation runs rather than reading it from your settings, so every branch it controls is inert in an ordinary session.

With CLAUDE_CODE_EVAL_CONFINED set, file-read permission checks reject anything outside the set of paths the run was allowed to read, and always-allow rules are honoured only when they came from a command-line argument, so allow rules written in settings files are ignored.

A new list names environment variables that point at credential and config files: AWS, Azure, GCP, Kubernetes, Docker, git, pip, Postgres, Vault, Consul, Nomad, Terraform, gpg, npm and gh, plus CLAUDE_ENV_FILE, CLAUDE_CODE_FEDERATION_CACHE_DIR and ANTHROPIC_IDENTITY_TOKEN_FILE.

Two mechanisms can inject extra instruction text chosen by matching the model name, one for batching behaviour and one as a secondary reminder, each sourced from CLAUDE_CODE_TOASTY_THIMBLE or CLAUDE_CODE_GENTLE_PARASOL or from a server-supplied map. Each applies once per conversation per model. Both existed before this release; the wiring around them has moved.

When Claude Code starts under a remote host and is given a pre-minted "work secret", it now attaches to an existing session directly using that secret instead of minting credentials through the usual OAuth flow. This only happens when the host supplies one and there is a session to reattach to.

The same confined-evaluation flag also stops cloud and background session creation, restricts always-allow rules to command-line sources, alters file hard-link and settings-source checks, and changes how MCP servers and hooks are loaded.

The /design command, which covers Claude Design sync, login, consent, revoke, import, export and status, is now behind an organization policy. Admins can disable it through managed settings, where it appears as "Design sync".

The agent proxy now serves its state at /__agentproxy/status while active, and resetting it clears one more piece of internal state than before.

A custom OAuth endpoint is now recognised purely from the CLAUDE_CODE_CUSTOM_OAUTH_URL environment variable, with the secondary fallback check removed. The same variable is also registered in the list the subprocess environment builder knows about, so it is carried as a recognised Claude Code variable when Claude Code spawns commands.

Whether directory sync streams changes is decided by CLAUDE_CODE_DIR_SYNC_STREAM. The check is an inversion, so streaming runs unless the variable is set to turn it off.

Turning Fast mode on or off, from /config, /fast or the fast-mode picker, now checks for in-flight turns and runs your PreModelSwitch hook against the model it would move to. If the hook denies it or answers "ask", fast mode stays off and you get an error telling you to run /model to switch first, then enable fast mode. This used to be an immediate state flip with no checks.

SessionStart hooks now receive the messages carried over from a resumed session, not just the bare start event, so a hook can inspect prior conversation content.

When publishing a versioned skill or artifact, authors can attach a short note describing what is new or reworked in that version. It is shown beside the version label in the version picker.

Changing model or effort level from the /model menu now runs hooks first, showing a "Running PreModelSwitch hooks…" spinner. A block decision cancels the switch and shows the hook's reason; ask sends you to the confirmation dialog with that reason as the prompt. Any system messages the hook returns are appended to the resulting notice.

The undocumented /radio command, described as "Listen to Claude FM lo-fi radio", no longer requires an internal feature flag that was off by default. It is now registered for everyone in interactive sessions.

A permission request that times out used to be rejected with a fixed message. The rejection message and behaviour now come from configuration, and if no such resolution is configured the auto-deny is not scheduled at all, so the request simply stays pending.

Cancelling in-flight work now revokes the pending follow-up items attached to it, matched by the cancelled item's id or its note id, instead of leaving them queued to run.

Trying to resume or fork a session that is currently running as a background session now explains the situation and gives the options: attach to it, stop it, or fork a copy. Previously this surfaced as a generic error.

A dialog can now declare that it should not interrupt an open panel, or should not interrupt when you have text sitting in the input box. Only dialogs that opt in behave this way.

A tool provided by an MCP server is now treated as enabled if a built-in tool of the same name is enabled, closing a case where a name collision could silently block the MCP tool despite permissions allowing it.

The Read tool no longer loads an entire file before deciding it is too big. Both the sync and async paths now read at most one byte past the limit and fail on the bytes actually read, so reading a huge file no longer costs the memory of the whole file.

The keyboard shortcut help gained a context for "when the proactivity menu is open", sitting next to existing ones like autocomplete and confirmation prompts. This is the first sign of an interactive menu for proactive suggestions.

The list of environment variable names Claude Code treats as auth-adjacent gained CLAUDE_CODE_ARG_KEY_SHAPE. Unlike the other names in that list, nothing else in this build reads or writes it, so setting it changes nothing today.

A compressed reference document on evaluating plugins now ships inside the binary and is unpacked at runtime, next to the agent proxy failure diagnostics. Nothing in the interface surfaces it yet.

The list of transient overlay states the CLI can be in, alongside autocomplete, confirmation, help and transcript, gained an entry for a proactivity menu, pointing at a new in-CLI suggestion surface. A new helper deliberately excludes that state from some other behavior.

A new keymap context adds keys for cycling proactivity levels and modes plus a dismiss key, active only while the proactivity overlay is showing and the agent view is not busy. Every cycling handler returns immediately without doing anything, so only dismiss works.

Artifacts now recognise a note field alongside favicon, label and description. On a URL-type create call it is ignored, as those other fields already are, because only type and title apply at creation time.

When the background backend is run as a daemon (CLAUDE_BG_BACKEND=daemon), startup now tries to acquire a controlling terminal for the worker, gated by tengu_bg_worker_ctty which defaults to on. Normal interactive sessions never reach this. If the gate is off it only checks whether a terminal was already acquired.

Two environment variables, CLAUDE_BG_DISPATCHER_SUBSCRIPTION_TYPE and CLAUDE_BG_DISPATCHER_RATE_LIMIT_TIER, now let a background dispatcher process learn its parent session's plan and rate tier without an API call. Both are read only when CLAUDE_CODE_SESSION_KIND is set to bg; in any other session kind they come back undefined and tier lookup falls back to the normal path.

CLAUDE_CODE_BRIDGE_OWNER_ACCOUNT_UUID and CLAUDE_CODE_BRIDGE_OWNER_ORG_UUID now sit alongside the other bridge variables in the list of environment variables passed through to child processes rather than stripped.

A capability that decides whether something is treated as first-party is controlled by the CLAUDE_CODE_DAPPER_LAGOON environment variable. Without it, two remote flags, tengu_foamy_spring and tengu_dapper_lagoon, decide, and both default to on when the server sends nothing.

When you pass an explicit socket path for peer messaging, Claude Code now checks the path and its directory up front and treats problems as startup errors rather than continuing with a quietly unusable inbox. The path must be absolute, free of .., and within the Unix socket path length limit, and the directory holding the socket must be a real directory you own privately at mode 0700, not a symlink. Key publication for peer authentication is held to the same standard.

Glob searches ignored files and dotfiles by default. Both are switchable through CLAUDE_CODE_GLOB_NO_IGNORE and CLAUDE_CODE_GLOB_HIDDEN, each defaulting to true. This pairing existed before this release; what is visible now is that the two variables map straight onto the underlying search's ignore and hidden flags.

When a plugin marketplace no longer sits where Claude Code recorded it, the refusal now explains the problem and the two ways out: re-add the marketplace, or, if it genuinely lives on a network path, declare it under extraKnownMarketplaces in your user or managed settings. The old text just pointed at /feedback.

If your organization has set a default effort level for the current model, /effort output ends with , set by your organization and the effort picker shows a note explaining it. When no org default exists, nothing extra appears.

A publish can now include thumbnail and thumbnailDark images. Their sizes are subtracted from the same total size budget as the rest of the published files, so a large thumbnail leaves less room for everything else.

The SDK set_model control request is now asynchronous. If the session is busy or has queued work, the model change is deferred and applied once the session goes idle rather than being forced through. Any notices the change produces are forwarded back to the caller, and a thrown error now replies set_model failed instead of leaving the request hanging.

The model field for subagents now says it takes a model alias, a raw model ID, or inherit, and that leaving it unset uses a configured default subagent model, falling back to the parent conversation's model when none is configured.