Claude Code v2.1.257

Setting the env var CLAUDE_CODE_CCR_SURFACE=tag adds a hidden default plugin marketplace, claude-tag-plugins, to plugin search and download: search requests add included_default_marketplaces: ["claude-tag-plugins"] to the request body, and the download URL builder appends included_default_marketplaces=claude-tag-plugins as a query param. With the variable unset, which is the default, neither path is taken.

Claude Code can now fetch, cache, and verify a signed remote "model catalog" document from https://downloads.claude.ai/model-catalog/v1/catalog.json (or a custom/managed URL). Signatures use RSASSA-PKCS1-v1_5-SHA512 checked against trust roots, with a hard-coded release-signing public key named claude-code-release-signing-key, and a compiled-in seed document is used as a fallback before the first successful fetch. This lets the model list, aliases, and defaults be updated server-side rather than only through app releases, with tamper protection from the signature check.

A new per-session hook, onAssistantRound, is now registered and invoked with { context, messages } after assistant/tool rounds, but only for the main agent. A second site assigns z.onAssistantRound = LWt for some subsystem, but what installs the listener and what it does is not yet clear.

Claude Code now supports an internal 'advisor' model concept, surfaced through the query context via getAdvisorSetting/advisorModel. When the advisor is active and the session isn't compacting, an internal meta message, Never consult the advisor tool., is injected into forked-agent prompts so sub-agents don't recursively call it. The advisor tool itself only runs when first-party auth is combined with a support flag or a remote experiment.

A new claude-fable-5-1 model id is recognized, along with a matching claude-mythos-5-1 variant. The fable family's default, best, and latest_per_family selections now point to claude-fable-5-1, though a gateway-specific override still uses claude-fable-5. UI text changes from "Fable 5" to "Fable 5.1".

The internal init-frame schema for headless/cloud-hosted sessions now includes a host block (handle, working_dir, platform, cli_version) announcing the local machine, and a serving block describing whether that machine serves Bash/Read/Write/Edit calls to the cloud session. serving reports a state of on, off, pending, or revoked, a policy of parity or interim (defaulting to interim), and a channel of session or bridge_only.

A new "check" artifact addon tool (addon: "check") offers local page preview plus runtime diagnostics for viewers, described as letting you "preview a page locally and read viewers' runtime diagnostics." It's added to the addon list alongside the existing comments and data artifact addons, but only exposed when either CLAUDE_CODE_ARTIFACT_VERIFY (or the tengu_osier_pylon_trace gate) or CLAUDE_CODE_ARTIFACT_PREVIEW (or the tengu_cobalt_plinth_aspen gate) is enabled. The verify path is forced off whenever CLAUDE_CODE_REMOTE is set, and the preview path additionally requires a headless-Chrome finder module to be compiled into the build, otherwise it throws "artifact preview is not compiled into this build." All paths are off by default.

A new Agents UI view and an EffortSlider component have been added, along with agents:switchView and agents:togglePin keybindings, pointing to a dedicated Agents panel with view-switching, pinning, and an effort-level slider control. Two new focus contexts were also added to the key-binding help system, one for the effort slider and one for the claude agents view.

A new "list instances" capability for Artifact types is now fully wired end-to-end: a client call to GET /types/{slug}/instances behind the artifact_type_instances feature flag, a tool-result builder returning fields like type, scope, instances, curated, hidden, more, overflow, dropped, and unavailable, and new terminal rendering showing either "instance listing not available to this account" or "listed N artifact(s) of this type". A related new "opened" artifact-link result renderer shows "Opened" with the resolved title/URL. Nothing yet in this area exposes the tool to a model, so what triggers this listing is not yet visible.

A new system-prompt identity block describes 'Claude Fable 5.1' as the newest model in Anthropic's Claude 5 family, placed in the Mythos-class tier above Opus. It shares weights with 'Claude Mythos 5.1', an unrestricted variant available only to approved organizations, and is selected when the model id resolves to claude-fable-5-1.

A new model, Mythos 5.1 (claude-mythos-5-1), has been added to the model catalog. It ships with a 1M context window, support for effort levels up to xhigh/max, and new capability flags including a dedicated prompt bundle.

New user-facing copy explains that Anthropic can remotely disable or re-enable "remote tool serving" — running commands on a user's machine from a cloud session — via an emergency switch, including notices for when it has been muted ("Remote tool serving was turned off by Anthropic (emergency switch)") and when it is unmuted again.

New scaffolding for muting and unmuting "served tools" has landed, gated behind tengu_violin_mute, with 'served-tools-muted'/'served-tools-unmuted' state labels, a jittered ~5-minute periodic timer helper, and a safe-call wrapper. None of this is wired to any caller yet, so it has no observable effect.

The CLAUDE_CODE_TOASTY_THIMBLE ephemeral-reminder mechanism now has a modelOwn fallback: when neither the env var nor client_data supplies reminder text, it can inject the instruction "First privately list what you need next; then request every item that doesn't depend on another's result in this one response." This only fires for models the model catalog tags with the server-side fable_5_1_prompt_bundle capability flag.

After a successful Write, Edit, Read, or Bash tool call, Claude Code can now assemble a tool.output telemetry event carrying details like file_path, content, and a diff for edits, or bash_command/output for Bash calls. A gating check function runs before any field is included.

The artifact multi-file capability check now also honors a new CLAUDE_CODE_ARTIFACT_MULTI_FILE env var, in addition to the existing feature flag.

The plugin hooks fetch event now supports an auth option resolved via $.session.authorize(), which mints an opaque handle. When the fetch's target host matches the authorized handle's host, the handle's headers are merged into the outgoing request; they're dropped again if a redirect crosses to a different host.

A new environment variable, CLAUDE_CODE_FORCE_MID_CONVERSATION_SYSTEM, forces the mid-conversation system-prompt-change path that was previously gated only by model and session heuristics.

Hooks now support a new hook.type === 'script' kind. The process output scanner parses <name> started, <name> result <json>, and <name> exited <code> markers from stdout/stderr to recover a structured result even when the script is launched through an intermediary runner or launcher. Conflicting or malformed markers set a resultConflict flag and produce a distinct "no single verdict" explanation.

A new plugin hook-API operation, model.fork, lets a plugin spawn a sub-query that forks the live main-thread transcript instead of starting a fresh agent context. The forked call strips trailing tool_use blocks, disallows tool use entirely (failing with "A model fork cannot use tools"), caps the fork at 2 turns, and reserves a 24000-token budget per call. If there is no warm main-thread transcript to fork from, the operation declines quietly with a debug log rather than throwing an error.

The plugin hook-API dispatch table gained a new session.authorize entry, callable as $.session.authorize(), which mints an auth handle for a session via C_.sessionAuthorize. It joins existing entries like session.cwd and session.model, and related internal code references it for handling unknown auth handles.

A new flag, --system-prompt-snapshot <on|off>, is now passed to spawned agent and subagent processes and threaded through session state as systemPromptSnapshot across many call sites. It lets a forked or background session record the system prompt once and reuse it verbatim on resume or subsequent requests, instead of recomputing it live. It defaults to on for the built-in system prompt and off when --system-prompt or --append-system-prompt is passed.

A new inheritPermissionMode option is now available among the headless/print entrypoint options, alongside existing ones like addDir and fallbackModel. It appears intended to let a spawned session inherit its parent's permission mode.

A set of environment variable names, including CLAUDE_CODE_ENHANCED_TELEMETRY_BETA, is now recognized for opting into an enhanced-telemetry beta.

The delivering_work_max system-prompt section can now be forced on via a new environment variable, CLAUDE_CODE_BISON_CAIRN, in addition to the prior heuristic checks.

New environment variables — CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR, CLAUDE_CODE_GATEWAY_TOKEN_FILE_DESCRIPTOR, CLAUDE_CODE_API_KEY_FILE_DESCRIPTOR, and CLAUDE_CODE_WEBSOCKET_AUTH_FILE_DESCRIPTOR — let auth tokens be passed to subprocesses via file descriptor instead of plaintext environment variables. The list of secret env vars scrubbed from subprocess environments was also expanded.

A new systemPromptSnapshot option records a conversation's system prompt once and reuses it verbatim on every later request and resume, instead of re-rendering appendSystemPrompt each launch. When a snapshot exists, mid-session model switches or system-prompt changes only take effect after compaction or a new session.

read_file/read actions for artifacts can now bind a local file to a live artifact document as a synced "working copy." New logic resolves liveFileCopyPathForRead, checks workingCopyLocationRefusal, and can refuse to overwrite an existing bound copy via snapshotOntoWorkingCopyRefusal. Read results can now include a working_copy field and a seq value.

Artifact publish gained a pr_review boolean parameter for publishing a composed PR review page, built from a structured JSON payload via the bundled review template, gated behind a feature check. The file_path for this flow names the structured payload .json that the artifact-pr-review skill authored.

The fleet-view UI now reads a bindings object (from ll()?.bindings) and passes it through as a keybindings prop to the layout, falling back to a default binding set when none is provided. This is groundwork for configurable keybindings in the fleet view.

A new keybinding context, EffortSlider, binds s to effortSlider:thisSessionOnly, mirroring the existing modelPicker:thisSessionOnly pattern. This appears to let users apply an effort-level change for just the current session from a new effort slider UI.

A new tool prompt instructs the model to surface recurring multi-step procedures from the session as skill proposals, a render-only card the user reviews and saves from, capped at 3 proposals per call. A saved proposal must replace the entire SKILL.md rather than apply a partial edit.

The seven-day overage-included usage limit label has changed from "Fable 5 limit" to "Fable limit." New model aliases fable-5-1 and mythos-5-1, mapping to claude-fable-5-1 and claude-mythos-5-1, have been added to the model alias table alongside fable-5 and mythos-5.

The single Artifact tool permission/telemetry surface has been split into three distinct tool identities: tools:ArtifactComments (comments, reply, resolve, watch, unwatch, status, resume_replies), tools:ArtifactData (read_db, write_db), and tools:ArtifactCheck (verify, preview). Permission rules and telemetry now attribute artifact actions to whichever of these three the action belongs to.

The native binary updater now fetches a manifest.json.raw-sig.json sidecar and verifies an RSASSA-PKCS1-v1_5-SHA512 signature over the manifest against a pinned public key before trusting the checksums and platform info used to download and install a new Claude Code binary. Releases that predate signing can still be accepted in some modes, and enforcement of the check is itself controlled remotely.

The tool-use renderer for the artifacts/canvas tool now handles new action types: version (showing a target url/label), open, and a trio of handler actions, get_handlers, call_handler, and run_script, which delegate to a new handlersToolUseLine renderer. The list action also gained type-filtered display, showing entries of a given type as shared or mine.

A new sent-prefix ledger, tracked per conversation, compares each outgoing request against what was previously committed to detect a model switch, a declared boundary, or a violation. When a tool description, input_schema, or system-prompt section has changed since it was first sent, it synthesizes a diff block for the model prefaced with: "The following changed since it was first sent in this conversation. The earlier text above stays as sent; where they differ, the current version below is the one in effect."

The policy-helper subsystem, used for managed and remote-armed permission settings, gains mid-session arming: a midSessionArmingEnabled flag plus new state (osAdminArming, decidedOrigin, remoteFailedConfig, releaseLatchWhenTickSettles, readRemotePayload) lets an OS-admin managed-settings source become the policy's "base" after startup rather than only at launch, announcing the tier change when it takes effect. Previously this decision was made once at startup only.

Artifact "open action" behavior is now controlled by the CLAUDE_CODE_ARTIFACT_OPEN_ACTION env var, falling back to the tengu_cobalt_plinth_willow gate (off by default). This replaces the prior behavior of the same function, which built an internal --computer-use-mcp MCP config, so it's a genuine behavior swap rather than a rename. Surrounding code enumerates browser executable paths (Chrome, Chromium, Edge, Brave), suggesting this governs whether an artifact auto-opens in a local browser.

The artifact-watch supervisor that keeps a live connection open on a published artifact for auto-reply/reconnect logic can now open either the old websocket transport or a new sync transport, which has its own URL builder, dedicated ping-frame keepalive, and 404/expiry-based reconnect detection. Telemetry marks these connections with sync_transport: true in the artifact_live_subscribe event. The live-subscription bootstrap logic now distinguishes a lease's transport as live or sync, validates sync leases against stored credentials, and returns a new sync_unavailable outcome when sync can't be established.

New validation logic supports telling the model "Background tasks are disabled in this session." and validates an optional tool_use_id string for background-task control, pointing to a new toggle for disabling the background task tool on a per-session basis.

When running as a 'confined evaluation child', Claude Code now skips the network fetch for remote settings entirely and instead serves a harness-written policy snapshot. This path is controlled by the evalPolicySnapshotOnly flag, which is itself gated by the CLAUDE_CODE_EVAL_CONFINED environment variable elsewhere in the code.

The device bridge for companion/remote device support can now be muted at runtime via an isMuted check, re-evaluated on a recheck interval. While muted, all tool and device announcements are withheld except a designated one, and a tengu_device_bridge_muted telemetry event fires.

New logic lets the assistant see tools added or removed mid-conversation via a fresh system turn re-normalized with surfaceLateToolAdditions, instead of only picking up tool changes at the start of a turn. Message normalization gains a toolChangeFallback path and a blocksEligible flag, but the behavior only activates when the beta capability mid_conv_tool_change is included in the request, which itself requires a Statsig-style gate to pass plus per-model eligibility, so it's gated off by default.

Two new keybinding actions, agents:switchView and agents:togglePin, are now recognized, alongside a new "Agents" UI context and an EffortSlider context.

The internal model alias list, used for model resolution/allowlisting, gained a new entry fable51 alongside the existing opus48, opus5, and fable5 entries.

Session and device summaries can now include a new whileClosed object describing device-serving state: armed, direction, firstUpload, or a closed reason. A companion serves boolean is derived from whether the device is bound and actively serving.

A new message table (J) generates the user- and model-facing prose for remote-tool approval edge cases: a host asking before tool use, entering plan mode mid-approval, a host going unresponsive during in-flight check-ins, unverified refusals, and withdrawal reasons including no_answer, host_withdrawn, superseded, evicted, tool_withdrawn, host_unbound, host_stopped, stale_answer, record_evicted, replaced_by_retry, and unrecognized.

A new system-prompt section, opus5_reduced_delegation, adds guidance text for Opus-class models. It's skipped if that guidance is already present in a cached memory value.

Four alternate "Saving skills" system-prompt blocks were added, covering different product surfaces: a direct edit-tool flow, a review-card proposal flow, a file-delivery flow where Claude can't confirm the user actually saved the file, and a "skills can't be created here" fallback that points users to claude.ai settings.

A new check-in loop periodically pings a remote host while a tool call is running, using the progress_checks capability with progress_interval_ms, progress_misses, and reconcile_ms settings. It distinguishes an unbound host from a generic host_unresponsive outcome when checks fail.

When running under the new CCR "tag" surface, plugin and skill search requests now include included_default_marketplaces: ["claude-tag-plugins"], so results can surface plugins from that marketplace by default.

The remote-control bridge now wires an onBackgroundTasks callback into session setup, alongside existing hooks like onDialogKindsDeclared, so background task state can be reported to remote control/bridge clients. A new background_tasks control_request subtype lets an external caller background a running local shell tool by tool_use_id, and remote clients can query or clear background task state via the task registry.

New generated instructions tell an agent exactly how to respond to a pending shutdown_request: call a specific tool with a JSON message containing the shutdown's request_id and approve set to true or false. The text notes that a plain-text acknowledgment does not actually shut the process down.

Remote settings fetching now has a fallback credential path for Workload Identity Federation (WIF): when no API key or user OAuth token is available, it obtains a bearer token via getWIFTokenCache/getWIFCredentials and marks the request with profileBearer: true. A 401 with this credential triggers one forced refresh and retry; if the settings endpoint rejects the refreshed token too, a settingsBearerRejected latch stops further retries with that credential until the next sign-in or restart.

The /btw command now keeps a history of past exchanges (btwHistory) and detects when a question is still in flight. Re-invoking /btw without a new question shows the prior response, or a fallback notice, rather than repeating the Usage: /btw <your question> prompt. Usage is now tracked via a persisted btwUseCount counter.

The --bg/--background CLI flag's help text now documents that combining it with --resume <session-id> continues that session in the background under the same ID, or starts a copy and reports it when the session is already running, rather than only starting a fresh background session.

Waking a background session to send it a new prompt now supports queuing that message so it's delivered once the session next starts, rather than requiring the session to be immediately available. Claude Code also warns if the flags passed for the wake don't match the flags the session was originally started with.

The artifact tool gains a version action that runs a dedicated version-resolution flow with retry progress reporting and updates the artifact's read-version state afterward; it's rejected if the live-doc module isn't available in the build, and re-validates the approved action and URL still match before running, guarding against a changed target between approval and execution. getToolUseSummary and the auto-classifier describe version as versioning an artifact with nothing uploaded.

Alongside version, a new open action lets Claude show an existing artifact read-only, distinct from list/publish, and is treated as read-only by the classification logic. New get_handlers, call_handler, and run_script actions add server-callable handler support, gated by boolean flags in the tool constructor and an ACTION description clause added to the schema when handlers are enabled; get_handlers is classified read-only, while call_handler/run_script are treated as writes unless a handlers-action-write check says otherwise. These gates are logged in the schema-build telemetry line and folded into the action enum.

A new CLI-internal update_settings tool lets host UIs merge settings into a settings file through the CLI's own writer, covering the canonical store, gitignore upkeep, and hardened writes, and live-applies them, mirroring what /config does. For now only the project's local settings file is supported and only the outputStyle key is allowlisted; it requires string values, refuses remote transports, and refuses sessions whose --setting-sources exclude the target file.

A new SDK control-protocol handler, update_settings, lets clients update the outputStyle setting only, requiring string values and disallowing deletion. It only works when the localSettings source is enabled for the session (see --setting-sources) and not over a remote transport.

The SDK query client gains an updateSettings(source, settings) method, which sends a new update_settings control-protocol subtype and is tracked under a dedicated telemetry span.

The CFC prompt's disabled state can now also be controlled with the CLAUDE_CODE_DISABLE_CFC_PROMPT environment variable, giving users and organizations a way to suppress it that doesn't depend on the existing internal check.

Policy or user settings can now suppress the confirmation prompt normally shown when entering dangerous permission mode, via skipDangerousModePermissionPrompt.

Settings-merge logic now allows permissions.defaultMode values of auto and bypassPermissions to be set from either project or local settings, whereas this was previously derived from a schema enum reference. Other default-mode values, such as acceptEdits, remain restricted to project only. This widens where these auto-approve modes can be configured from and is not behind a flag.

Permission-mode resolution now detects when an agent's frontmatter permissionMode would widen the effective mode inherited from a parent or agent view, and ignores that widening instead of applying it. This closes a path where a repo-controlled agent definition could loosen permissions beyond what the parent context allowed. The event tengu_agent_frontmatter_mode_widening_carry_ignored is logged whenever this happens.

Artifact-read failures now give channel-aware guidance for Slack and Teams: a 403 can report that the artifact is agent_not_added or agent_owned by another channel's Claude, and instructs the user to add the Slack or Teams channel under Share settings instead of sharing with an individual.

On startup, Claude Code now checks whether userSettings.model is set to claude-fable-5 or claude-fable-5[1m] and automatically rewrites it to fable or fable[1m]. The migration fires telemetry tengu_fable5_to_fable_alias_migration and increments a dedicated failure counter if the rewrite doesn't complete.

When resuming, Claude Code now scans the session's JSONL log for parentUuid markers and a "continued-in" system record to detect whether the most recent conversation moved into another, possibly background or remote, session. If it can prove that other session is still running it says so ("provable"); otherwise, for a session registered from another machine or container, it reports that this session can't tell whether it is still running.

The same widening protection now applies to settings.permissions.defaultMode: if a project or local settings file would widen the effective permission mode, that widening is ignored. This is logged via the new tengu_settings_mode_widening_carry_ignored telemetry event.

The tool-permission-check function no longer includes the earlier mode === "plan" short-circuit refusal branch (the plan_mode code) that existed in the prior build. Refusal now proceeds through the request-size and ask-rule checks instead.

The shell-exec helper now checks a new diskless-session flag before running any command. If the session is diskless, it throws immediately with a new error code instead of spawning a shell, reporting that shell commands are unavailable in this session and the command was not run.

A new hostCredential permission-rule source type, labeled "cloud-session credential guard" in UI text, has been added and is handled alongside existing sources like session, toolsNarrowing, and mcpServerPolicy.

A new fable_5_1_prompt_bundle gate is used in several places, including model naming/labeling and forcing thrifty_sonic, to special-case the fable model family.

A new signature-verification path checks managed-settings and policy-limits caches against embedded trust roots, using JWS with an x5c certificate chain and ES256. It computes age, cert-expiry, and chain-validation results, but currently only emits telemetry (tengu_signed_cache_shadow) rather than enforcing anything, as a shadow rollout of cache integrity checking.

Prompt/context assembly now computes which prefix-ledger sites changed since a prior render epoch, with a mode that can either inject a notice about them into the model's context or run shadow-only and just log via tengu_prefix_ledger_notice. The mode-selection function is currently hardcoded to "off", so this notice does not fire in this build.

Four new consent-tracking fields — artifactHandlersReadConsentSlugs, artifactHandlersReadHumanConsentSlugs, artifactHandlersWriteConsentSlugs, and artifactHandlersWriteHumanConsentSlugs — were added alongside the existing artifact asset consent slugs. Artifact "handlers" (scripts) now get their own read/write consent gate distinct from artifact assets.

Transcript rendering now threads followsSpeakerLabel and followsInboundLabel props through message rendering, including on rendered user message parts, and the transcript component gained an isFocusedTurnLoading prop. This supports teammate/mailbox-style conversations where messages are grouped under a sender label, adjusting verbosity and spacing based on whether a message immediately follows a speaker or inbound label, including how "Message from X" banners are shown.

A new speaker_label render case was also added to the transcript message renderer, showing a SpeakerLabel component with speaker and timestamp when a plugin registers hs.SpeakerLabel, alongside a new work_segment case.

Startup now gates reading of several file-descriptor-based secret sources, the OAuth token FD, gateway token FD (CLAUDE_CODE_GATEWAY_TOKEN_FILE_DESCRIPTOR), API key FD, and websocket auth FD, behind !$e(a.CLAUDE_CODE_REMOTE). "Remote" entrypoint detection now also treats CLAUDE_CODE_REMOTE being set together with a resolved websocket or gateway token as a remote entrypoint.

The compiled-in seed document used before the first successful published-catalog fetch lists claude-opus-5, claude-sonnet-5, and claude-haiku-4-5 as the model roster.

A new bf() helper writes a cached organization managed-policy snapshot into the eval sandbox's config directory so that eval subprocesses inherit the remote-managed policy tier. If no cached policy exists yet, it warns instead, and the child sandbox runs without the remote-managed tier.

Eval sandbox subprocesses now receive OAuth and gateway credentials through a new vf() helper instead of directly via environment variables. On non-Windows this uses CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR (or the gateway equivalent); on Windows it writes a snapshot.json under a claude-eval-auth- temp directory and points CLAUDE_BG_AUTH_SNAPSHOT_PATH at it. Stale snapshot directories older than 2 hours are cleaned up automatically on startup.

Whether a model supports xhigh_effort, effort, or max_effort is now determined by looking up a per-model effort-level list through a shared helper, instead of matching the model name against a hardcoded string check. Effort tiers are effectively becoming data-driven per model rather than tied to a fixed list of known model names.

The model-description schema now includes max_input_tokens, max_output_tokens, effort_levels, default_effort, capabilities, family, knowledge_cutoff, default_for_family, and fast_default_for_family fields, adding richer per-model metadata for effort and capability handling.

The model family resolver now recognizes model strings containing fable-5-1 or fable_5_1, mapping them to a new zl().fable5 target that is distinct from the existing fable-5 handling.

The auth-taint classification function now checks a new l4t() gate before allowing the allowed_taints_clean or allowed_untaintable states. If the gate returns false, the state becomes blocked_unsettled instead of being allowed through unconditionally.

The conversation-context renderer now handles several new synthetic event kinds: prefix_delta and fork_briefing, both of which inject meta text content, and remote_session_change, which only renders when the IAe() gate passes. async_hook_response_batch is now explicitly treated as a no-op.

The internal app-state facade exposed to permission and session logic gains a getAdvisorSetting() accessor (returning advisorModel), alongside existing getters like getMcp and getProactivityLevel.

A new environment variable, CLAUDE_CODE_CCR_SURFACE, is now preserved and passed through alongside CLAUDE_CODE_ENTRYPOINT and CLAUDE_CODE_IS_COWORK.

A new cost table entry, tier_10_50_cache_read_0_25, adds pricing for a model tier at $10 input / $50 output per the usual unit, with a $0.25 cached-read rate, joining existing tiers like haiku_35.

The permission-request flow now threads an askPatience object with hold()/resume() calls around showing the dialog, delaying it until a first reveal point (onFirstReveal). An askEnded() check also now routes a cancelled or denied prompt back into an "ask" state instead of failing outright.

Agent and session dispatch now tracks whether permissionMode came from an explicit override or was inherited. A permissionModeInherited flag is added to the dispatch defaults whenever the mode falls back to inheritPermissionMode.

The approval flow for remote tool calls now tracks a patience/lapse duration and can resolve to an 'ended' outcome instead of a decision. This short-circuits to a dedicated result path rather than treating the permission prompt as simply withdrawn or failed, so a prompt that gets superseded mid-flight is handled distinctly.

Attaching to a remote or cloud session now runs a dirSyncElsewhereLookup check in parallel with the rest of the reconnection work. Its result is passed through as dirSyncElsewhere in the remote session config, so the client can avoid silently re-establishing directory sync when one already exists elsewhere.

The Artifact-type discovery prompt now documents how to list and apply reusable sub-types, such as design systems, to a new Artifact via action:"list" with a type/type_url. It defaults to the org's default type without asking, or asks the user when several such types exist and none is marked default.

The comments/artifact tool no longer relies on a hardcoded set of macOS bundle identifiers (Safari, Chrome, Slack, Zoom, Notion, etc.). It's now a proper comments addon tool that can read and reply to comment threads on a published artifact and watch it for republishes, gated behind a gateOpen check.

Claude can now list the Artifacts created from a given Artifact type, identified by name or type_url, scoped to mine, shared, or all. Results include titles, links, descriptions, and default markers, and the tool instructions explicitly warn that this returned data must be treated as untrusted content.

When an artifact's watch rail is live, the tool prompt now documents a way to resume automatic replies: action: "watch" with replies: true re-enables automatic comment replies that were stopped or paused, for example by Ctrl+C. This only applies when the user explicitly asks for it, and it cannot override a session-wide kill-all-agents auto-reply disarm.

When a background job is respawned with an initial prompt while a prompt is already queued, the new prompt can now be appended (with deduplication) to the existing queued prompt instead of overwriting it, controlled by a new keepQueuedPrompt option.

The artifact publish pipeline (di, formerly Mo) now accepts a set of files instead of just single content, and can mark some of them as "live." It tracks a new n_files telemetry field and returns a bornLive set of paths that started live.

A new conflictsOnLaptop notifier tells Claude when files in the synced checkout hold the user's unresolved merge, rebase, cherry-pick, revert, or stash-pop conflict markers. The notice clears once the user resolves or aborts the operation.

MCP elicitation handling moved from a single async function into a stateful class that tracks per-URL elicitation flows. It adds a distinct mcp_elicitation_waiting dialog state, shown after accepting a URL-mode elicitation, with a "Skip confirmation" action, and the flow can now be explicitly completed or abandoned via server completion notifications.

Tool result messages now include a resource_links field that collects the raw resource_link content blocks returned by an MCP tool (up to 50 links or 64 KiB), as a sibling to _meta on tool_use_result.mcpMeta. This lets a host render referenced files directly instead of parsing the [Resource link: NAME] URI text line; it is absent for subagent tool results. Both live MCP tool calls and MCP task-based tool calls now capture and pass through resourceLinks/resource_links, including in the background-task terminal summary.

The status-line narration generator now counts rounds per turn (roundsThisTurn) and only fires once that count exceeds a threshold, instead of firing on every message-length change. This delays the "thinking about..." style status narration until a turn has been running for a couple of rounds. A new subsystem builds a digest of the current turn (user request, recent steps, task list, running tool calls) and asks a model to write a single-sentence terminal status line summarizing progress, logged as [narration] refreshed.

The main session loop now wires up a reopener for a /btw slash command tied to session history (btwHistory). When triggered, and no active model turn, ended-by-model state, or local JSX UI is blocking it, it automatically submits /btw via the prompt input, providing a quick-capture/aside command flow.

/review's --comment flag now works against GitLab merge requests: when the target is a GitLab MR, findings are posted as a single general MR note via glab mr note ... -m "<body>", falling back to printing the findings if glab isn't available or the target isn't an MR. The --comment/--post explanation text now branches by target, describing GitHub inline PR comments separately from the GitLab general MR note behavior.

A new doctor diagnostic scans configured deny-within-allow filesystem paths on Linux/WSL for zero-byte, non-writable leftover mask files from a killed sandboxed session, since these can silently break "don't ask again" persistence. It surfaces a paired issue and fix telling the user to remove the stale file.

A new timeFormat setting is available in /config under "Time format," controlling the clock format used for times shown in the UI. Options are auto (default, follows the locale), 12-hour, 24-hour, 24-hour-utc (e.g. 18:05Z), or a strftime pattern. Changing it fires tengu_time_format_setting_changed telemetry.

Two new settings.json fields control how times render in the UI. timeFormat accepts auto, 12-hour, 24-hour, 24-hour-utc, or a strftime-style pattern, and timeZone accepts an IANA zone name, falling back to the system zone if the value isn't recognized.

The served model catalog now persists a masked-ids.json file that tracks which model ids should stay hidden across sessions. If this file is found corrupted or in an unrecognized format, it's quarantined and recovered rather than causing a failure.

Keyboard shortcuts in the background-agent (fleet) view for switching group view, opening the external editor, and toggling a pin are no longer hardcoded to ctrl+s/ctrl+g/ctrl+t. They now resolve through a keybindings table lookup using named actions: agents:switchView, chat:externalEditor, and agents:togglePin.

CLAUDE_CODE_CCR_SURFACE, CLAUDE_CODE_MODEL_CATALOG_URL, and CLAUDE_CODE_ARTIFACT_OPEN_ACTION are now included in the set of environment variables Claude Code preserves and passes through, for example to subprocesses or sandboxes.

A new run-deduped cache plus a server-backed tool-count path can replace local estimation of tool definition token counts when analyzing context usage, falling back to the previous local estimator on error or when the tengu_peppy_zephyr gate is off. The feature is still gated off by default.

The effort-level picker's confirm flow now supports pressing s to apply a chosen effort level for the current session only, without saving it as the default. Enter still confirms and persists the choice as default, and the picker's help text and hint row now mention the s option.

The get_context_usage tool call now accepts an optional detail parameter of 'summary' or 'full'. 'full' is the default and performs per-category token-count API calls, while 'summary' answers from the last response's usage plus local estimates without extra API calls.

The internal tool.call hooks API, used by plugin- and skill-authored tool invocations, now also accepts an optional consent string, which is injected as a synthetic human-origin message into the session context before the tool call runs.

All MCP tools that aren't marked always-load are now deferred by default: the internal opt-out check is hardcoded to return false, so MCP tool metadata loading is deferred unless a tool is otherwise force-included.

A check that previously raised a HooksError refusing to let a hook target "an Anthropic-operated host" has been removed, leaving only the private-host refusal in place. This loosens which hosts a hook is allowed to reach.

The boot-time artifact live-subscribe call now computes agentPeer and syncLive flags before treating a connection as agent-peer/sync-live capable. Both flags come from a helper that requires a gate to be on plus two other conditions, et(e)===null and !rnr(e). This capability is off by default.

Finding fe546477ccfcf6f4

The artifact comments/watch tool now steers users toward a new action vocabulary. Use read instead of comments, watch with on:false instead of unwatch, watch with no url instead of status, and watch with replies:true instead of resume_replies. Using an old action name now produces a validation error explaining the new spelling.

When starting a new Artifact from a type, the guidance now recommends passing auto_open: "after_first_write" on the initial type-only publish, so the artifact opens automatically once its data files are filled in.

The warning shown when Claude Code doesn't recognize a model and falls back to an assumed context window for auto-compact has been reworded. It now consistently references CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1 as the way to restore the previous wait-for-the-API behavior.

The env var and telemetry flag controlling print/engine loop behavior have been renamed from CLAUDE_CODE_PRINT_ENGINE_LOOP/tengu_print_engine_loop to CLAUDE_CODE_HUMBLE_HAMMOCK/tengu_humble_hammock. The setting still defaults to off.

The $.audio.play hook API's loop option has been renamed from loop to shouldLoop, including in its error message. This is a breaking change for any hook code that still passes loop.

A new internal capability flag, forceable via the CLAUDE_CODE_STELLAR_DRIFT env var or gated by an experiment named tengu_stellar_drift, has been added; its behavioral effect isn't documented here.