Claude Code v2.1.260

The model picker adds a "Fable" model family, listed with the description "Fable 5.1 · ...". Internally it references claude-fable- model identifiers and is gated by a new entitlement probe, fableEntitlementProbe.

The whiteboard-artifact skill now has two full variants: the existing solo canvas, and a new live/collaborative one where everyone with the board open sees each other's strokes and cursors as they happen, the board shows whether a given session is present, and drawing can happen live alongside sending messages. Which variant loads is decided by ze(), which sets whiteboardVariantLatch to "live" only when both Cbn() and Ele() are true, otherwise "solo". Separately, the whiteboard skill as a whole is only enabled when Tbn() and fk() both hold.

A new hidden built-in command, advisor ("Let Claude consult a stronger model at key moments"), has been added, including non-interactive support and an argument hint listing available advisor models plus off. It stays hidden and disabled unless two internal gates both pass.

Plugin hook scripts can now call $.process.run alongside the existing fs.*, store.*, and http.fetch namespace, letting a hook spawn and run arbitrary external commands rather than only reading files or making HTTP calls. The implementation validates arguments, handles SIGTERM-then-SIGKILL shutdown, caps captured stdout/stderr size, runs under toolCgroupClass: "plugin", and applies default and maximum timeouts.

Plugin agent.spawn hooks can now intercept the Task tool's subagent-spawn path: a hook can deny a spawn outright, or rewrite its agent type, prompt, description, cwd, model, or background flag before launch. New guardrails accompany this: agents renamed by a hook get their MCP requirements rechecked, cwd changes are rejected when isolation is worktree, and a hook can't retarget an unconfined web-fetch dispatch to another agent without classifier review.

A new advisor option, Fable 5.1, can be reviewed and enabled by running /model fable (in an interactive terminal session if needed), after which it can be set as the advisor.

A new managed-settings key, sshHostAllowlist, lets admins list SSH hosts (exact hostnames or *. wildcards) that users may connect to for Claude Code desktop sessions run over SSH; if it's unset or empty, the SSH option is hidden and connection attempts are refused. Allowed connections forward the session's inference credential, but only if it's token-based — file-based credentials such as Bedrock IAM Identity Center or Vertex creds are refused — along with the OTLP endpoint and auth headers. This is an opt-in beta feature.

The Usage page can now show a USD cost estimate per model, priced at Anthropic list price by default. It is controlled by a new inferenceModelPricingEnabled toggle (off unless explicitly enabled), and can be refined with inferenceModelPricingMultiplier and inferenceModelPricing, which sets per-model USD/Mtok rates for input, output, cache read, and cache write.

Claude can now create a whiteboard artifact: a live collaborative sketch canvas with boxes, databases, decision diamonds, sticky notes, arrows, freehand drawing, text, and pasted images, plus shared live cursors and strokes, intended for wireframe-style diagramming discussions.

Auto-mode's bash-first steering behavior now has a configurable strictness setting, resolved from an env var and then org/user config, defaulting to strict. The resolved value is attached to the auto_mode payload as bashFirstSteer whenever bash-first mode is active. The env var involved is CLAUDE_CODE_COZY_TEAPOT.

An artifact action set, get_endpoints, call_endpoint, and run_script, now checks a module-level variable before allowing use. When unset, permission is denied with the message "artifact endpoints are not available in this build," indicating the capability is compiled in but only enabled in certain builds.

Artifacts now support copying another artifact's assets via copy_from in sessions where that capability is available. Where it isn't available, a new error message clarifies that asset: true can be used instead with a local file_path. A UI toast now reports "copied N asset(s) into the artifact" for asset_copy results, and new frozenCopyFrom / frozenMultiFile flags were added to artifact runtime state.

The artifact tool now supports a copy_from action for copying assets between artifacts. Errors are reported with dedicated cases: a copy-specific not_found message that identifies the source artifact, a new asset_not_found case, and a new not_copyable case, and the permission checker's action allow-list now includes copy_from.

Setting the CLAUDE_CODE_QUESTION_EXTENDED environment variable now enables an "extended questions" mode for the AskUserQuestion preview feature, via host.launchOptions.replaceExtendedQuestionsEnabled(true). It only applies when the entrypoint is one of sdk-ts, sdk-py, sdk-cli, local-agent, claude-desktop, or claude-desktop-3p, or when the client type resolves to remote; it is off by default with no fallback-true case, and it is stripped from subprocess and MCP-child environments so it won't propagate.

Claude Code can now auto-draft and post replies to comments on artifacts it can reach, guarded by a new permission rule for the pseudo-tool action action:reply, which can be persisted at session or userSettings scope. In ask mode, an unanswered request to reply now defaults to declining (defaultToNo: true) for non-subagent contexts. If you decline a drafted reply with feedback, the session records a system note quoting your reason and stops drafting further replies to that artifact's comments for the rest of the session.

AskUserQuestion now supports text and number question kinds in addition to multiple-choice. These kinds skip the requirement of at least 2 options, and validation errors for open-ended questions now suggest re-asking with "kind": "text" instead of demanding options.

A new mode-resolution helper picks which permission mode to switch to based on context: from proactive it chooses bypassPermissions if available, otherwise auto or acceptEdits; from ask or default it prefers auto mode when available. This appears to back a new auto-accept/proactive option in permission settings.

The usage-limits schema, parsed by the new teo zod schema, adds a cinder_cove field alongside the existing five_hour/seven_day buckets. When present in the parsed response, the settings UI renders it as a separate usage bar titled "Claude Code and Cowork credit," described as a one-time credit with an optional expiry drawn from resets_at. The bar stays hidden until the backend actually sends cinder_cove.

The Artifact tool's prompt text for host MCP servers now documents a built-in exception, host:claude_browser, which lets a published Artifact declare the Claude desktop app's own browser tools — read_page, get_page_text, find, preview_start, navigate, computer, and form_input — as a host server. Previously only user-configured local MCP servers could be declared this way.

builtinToolPolicy and disabledBuiltinTools now accept argument-scoped rules like Bash(curl *) or Read(**/secrets/**), not just bare tool names. New parsing and validation logic, parseBuiltinRule and canonicalBuiltinRule, backs this and warns on malformed entries.

Publishing an Artifact can now pass a type_url to start a new Artifact from a published Artifact type (a template/starter), along with a title. The result is an ordinary private Artifact whose type page and files stay fixed while the rest remains editable. The publish tool description and the title-field help text were both updated to describe this.

The AskUserQuestion tool now supports question kind values beyond multi-select: text and number, with min/max validation for numeric answers. It also supports a followUp flag; when set, the tool's returned message tells the model to call the question tool again with follow-up questions that build on the given answers, rather than proceeding with the task.

Two new config fields extend Claude.ai session import: automatic3pImport lets organizations enable a one-time automatic background import of a computer's earlier third-party Claude sessions, and exportEnabled lets users export their chats, Cowork tasks, and Code sessions as a portable zip. Both are independent of the existing import-enable toggle.

A new /background-style dialog lists remoteBackgroundTasks running in the cloud session. Pressing x sends a stop_task control request, and the dialog shows a "stopping…" state along with error text if the stop fails.

A new collapsible panel above the input prompt, AbovePrompt/AbovePromptInput/AbovePromptSelect, lets plugins render buttons, inputs, and selects, navigable via tab, arrows, enter, and escape. Two new default key bindings were added: ctrl+x ctrl+a toggles the panel (abovePrompt:toggle) and ctrl+x tab focuses it.

A new config key, claudeInChromeEnabled, is set entirely by Anthropic's control plane from the org's Claude in Chrome admin setting, not by any local MDM or bootstrap config. It controls whether Cowork/Code sessions can drive the user's Chrome/Edge browser via the extension — navigating, reading the page, clicking, typing, and taking screenshots. Desktop and the extension pair via a signed identity check against the Anthropic API, this requires isLocalDevMcpEnabled to remain enabled, and it's available on macOS/Windows only.

The artifact tool's copy_from action is now gated by a new Are() capability check in addition to the existing assets capability, stored as frozenCopyFrom. The gate reads the tengu_cobalt_plinth_samphire flag, which is new to this build, so the action's enum entry and description only appear when both checks pass.

The artifacts tool's permission-check dispatcher recognizes the new copy_from action, letting Claude copy assets from one published artifact into another server-side, but the action is also guarded by an account-level check that currently resolves to disabled: calling it returns an explicit "action copy_from is not enabled for this account" error.

When auto/bypass mode qualifies for "bash-first" steering, mode metadata now carries bashFirstSteer: Y7n(). Y7n() resolves CLAUDE_CODE_COZY_TEAPOT, then a remote-settings/local-config lookup keyed by tengu_cozy_teapot, falling back to the literal "strict" if nothing is set. When bashFirstSteer resolves to "relaxed", a looser system prompt is used ("The choice is yours: prefer Edit or Write when a shell edit would be fragile...") in place of the default stricter prompt that pushes almost everything through Bash.

A new tool, enable__mcp__claude-in-chrome (with a generic Browser variant), does nothing but tell the model that browser tools are already available under names containing Claude_Browser, or to use claude-in-chrome/Claude_in_Chrome tools directly, so the model stops trying to invoke a non-existent "enable" step. It only registers when the session runs under a CCR session profile, requiring CCR_SESSION_PROFILE, a valid SESSION_INGRESS_URL, a CLAUDE_CODE_REMOTE_SESSION_ID matching the cse_... pattern, and a first-party check; outside that remote/cloud profile the tool is not registered at all.

A new experiment, tengu_wise_comet, controls whether the CLI strips extended-thinking content, but only applies when the thinking type is "adaptive"; other thinking types force stripping off. An env var override, CLAUDE_CODE_WISE_COMET, is also available.

A new CLI subcommand forward-home-settings is now recognized, joining the existing install/update/rollback and update/upgrade/doctor verbs.

The thinking-block renderer for assistant messages now takes a model prop and, for string models, checks a quizzical_shore experiment via a capability-logging helper, falling back to the tengu_quizzical_shore gate. When either resolves false, a hint node is shown alongside the trimmed thinking text. The message's model (X.message.model) is now threaded into the renderer specifically to support this check.

A new modelPrefer1mContext config, along with a per-model prefer1m field, makes the model picker start on the 1M-context variant of the default model for users who have no saved selection, instead of always defaulting to the standard context window.

Adaptive thinking mode is now the shipped default for per-turn thinking behavior. Setting CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING forces the older enabled mode instead, but only when the canonical model name includes opus-4-6 or sonnet-4-6; otherwise adaptive mode applies as normal.

The artifact tool's asset store now supports a copy_from action that copies assets from one artifact into another entirely server-side, with no download or re-upload. It takes a destination url, a source from_url, and up to ten asset_ids, and requires the requesting session's approvals to cover the copied files ("files: copying another artifact's file needs the user's approval"). Reading an artifact's assets now also covers server-side copies of them into other artifacts.

Artifacts and assets gain a copy action, exposed as asset_copy and copy_from in the action lists, along with new error kinds not_found, asset_not_found, and not_copyable for when a copy fails.

A new remoteControl.shareHostProfile setting controls what a Remote Control environment learns about the local machine when it registers. off reports nothing, basic reports OS/architecture/dev tools, and full also reports configured MCP server names (never the contents of a repo's .mcp.json). If left unset, the level falls back to remote rollout config. Managed settings, --settings, and user settings combine to the most restrictive value among them, while project and local settings can only lower the level further, never raise it.

Approving certain Bash calls can now silently create a persistent local allow rule. When keepsStandingApprovals is set on the input and the command is a clean, non-wildcard, single-line string under a length cap, the approval emits an addRules action that allows that exact command in localSettings.

A new organizationInstructions managed setting lets admins configure free-text guidance, up to 3000 characters, that Claude Desktop appends to the system prompt in Chat, Cowork, and Code sessions. It is described as guidance the model follows rather than an enforced control.

The footer hint line near the input area can now show a proactivity indicator, driven by new proactivityLevelStepped and proactivityPillCollapsed props that control a level pill and whether it's collapsed.

Unsandboxed shell command dispatch is now also permitted when the request has userTypedShellDispatch explicitly set to true, in addition to the existing areUnsandboxedCommandsAllowed() check.

The new "Precompute compaction" settings toggle (precomputeCompactionEnabled) only appears in the settings list when the tengu_sepia_moth gate resolves true. The feature's own gate function independently re-checks tengu_sepia_moth before consulting the stored setting value, so a saved preference has no effect unless the gate is enabled.

Custom credential helper scripts now receive a CLAUDE_HELPER_CONTEXT environment variable, with values such as interactive, mid-session-refresh, background, scheduled-task, and setup-test. Helpers can use this to decide whether it's safe to prompt the user interactively.

claude rm <id> gains a --discard-unpushed <commit>@<worktree-id> option to delete a background session's worktree even when it has unpushed commits or uncommitted changes, provided the worktree is still at the commit last reported. When claude rm refuses to delete a worktree with unpushed work, it now reports the exact <commit>@<worktree-id> value to pass to this new flag.

Two new settings let an org lock down plugin extensibility in third-party mode. userPluginMarketplacesEnabled, on by default, controls whether users can add their own plugin marketplaces. userPluginUploadsEnabled, also on by default, controls whether users can upload or create their own plugins. Turning either off hides the corresponding in-app add surfaces and refuses adds that still reach the app.

The AskUserQuestion tool's question schema now supports "kind": "text" for an open text box and "kind": "number" (with min, max, step, defaultValue, and unit) in addition to the existing option-based questions. Guidance now also steers away from adding 'Other' or 'Skip' options and instead encourages asking follow-up questions when the user wants more.

Two new settings let a bootstrap config server require authentication on its config fetch: bootstrapHeaders for static headers, and bootstrapHeadersHelper for an executable that prints headers as JSON, with its output cached for a few minutes. This supports a service-account credential or rotating token without embedding user:pass@ in the URL.

Connected cloud/remote sessions now expose a read-only Skills dialog listing the skills that session reported as loaded, distinguishing "no skills loaded" from "hasn't reported yet." Per-skill toggles still have to be changed in a local session; /reload-skills re-scans the cloud session's skill folders.

A companion read-only /memory-style dialog shows the memory files (CLAUDE.md etc.) loaded in a connected cloud/teleported session, separating files sent from the local machine at launch from files that only exist in the cloud session's own ~/.claude; local editing is blocked with an explanatory message.

A new Permissions settings panel (Allow/Ask/Deny/Workspace tabs) displays the allow/ask/deny/additionalDirectories rules from a connected cloud session's settings files, fetched via a new get_settings control request. It's explicitly read-only: local /permissions edits don't apply to the cloud session.

A new authFlow setting for inferenceGatewayOidc and inferenceVertexWorkforceOidc (flat key inferenceGatewayOidcAuthFlow) chooses between browser and broker sign-in. The broker option routes sign-in through the OS identity broker (Windows Web Account Manager or macOS Company Portal) instead of a system browser, but requires the IdP to be Microsoft Entra ID and is not supported on Linux.

A new managed-config field, mcpToolTimeoutSec, lets an org set a per-call timeout of 60-3600 seconds for MCP tool calls. Cowork/chat already defaulted to 180s, but Code sessions previously had no desktop-imposed MCP timeout; setting this key now gives them one, and the desktop's own request deadlines toward managed and user-added local MCP servers follow this value.

Desktop config settings gained three new permission-group categories: TOOLS_GROUP (built-in tool restrictions and on-demand MCP tool loading), CODE_SURFACE_GROUP (settings for Code sessions, applying only while Code is enabled), and UPDATES_GROUP, joining the existing General restrictions, Anthropic telemetry, MCP servers, and Bootstrap groups.

Plugin dev mode now watches plugin directories and automatically reloads a plugin, or its hooks module, when relevant files change, debouncing rapid successive changes. If a plugin reloads more than a configured number of times in quick succession, reloading pauses and the user is told the latest save will load once the directory is quiet, or that they can run /reload-plugins to reload immediately.

A new bundled skill teaches how to write or debug a Claude Code plugin built from function hooks, covering register(on, options) and hooks on tool.call, prompt.submit, ui.render, session.start, and similar events.

A new skipWebFetchPreflight setting skips Claude Code's WebFetch domain-safety lookup against api.anthropic.com in Code sessions, useful when that host is firewalled off in third-party deployments.

A new otlpAuthMode setting lets OTLP collector authentication reuse the signed-in inference credential, sending it as Authorization: Bearer <token> on OTLP exports instead of relying only on static headers.

Plugins can now render Button, Input, Select, and Link elements in the desktop/terminal UI, in addition to the previously supported Box, Text, div, span, b, and Svg. Press-wrapping dispatch logic now also handles Input and Select, not just Button, giving plugin UIs interactive form-style controls.

Connector and hook config is now scanned for credential-shaped header names (like Authorization, Cookie, or X-API-Key-style patterns) or values that look like bearer tokens, JWTs, AWS access keys, or common vendor secret formats (sk-, ghp_, AIza, GOCSPX-, glpat-, and others). When found, Claude Code warns you to use a headers/credential helper script instead of storing the secret directly in the config file.

The --watch-artifact CLI flag now accepts a short, base58-style artifact id directly, decoding it into a full artifact slug before falling back to the existing slug-regex or URL parsing. Previously only a full slug or a claude.ai artifact URL was accepted.

The artifact publish tool now accepts a copiedFiles list, letting a publish operation copy files in from other artifacts. The response echoes these back under copied, with from_url and from_path for each copied file.

The built-in artifact/site tool's get_handlers and call_handler actions have been renamed to get_endpoints and call_endpoint. A new copy_from action has also been added alongside the existing list_files, read_file, and delete actions, for copying assets between artifacts.

Starting a new Artifact from a published type now requires passing a title (what the user called it, or a short descriptive name) alongside type_url, in addition to the type's own instructions being returned. The tool description was also reworded to distinguish types filled through their own data store from ones filled with page/data files: for store-backed types, the model should call the store-write path or run_script rather than publish files.

The built-in WebSearch tool can now be disabled entirely or gated behind per-search approval by listing the bare WebSearch name (no per-host scope) in disabledBuiltinTools or builtinToolPolicy.

The gateway's OIDC config schema gains a scope_on_refresh boolean option, sitting alongside existing settings like use_pkce and userinfo_fallback, to control whether scope is resent when a token is refreshed.

A new plugins-management view shows which plugins a connected cloud session loaded, or notes that it hasn't reported yet, and explains how local plugin changes propagate to that session via /cloud-plugins or /reload-plugins.

The diff view now decides between the sidebar diff UI and the full DiffDialog based on an explicit presentation === "fullscreen" flag, rather than inferring it from other state. The /diff command's immediate-availability check and description text were updated to match this new fullscreen distinction, and the contextual notification hinting at enabling tmux mouse support is now shown only when presentation mode is fullscreen.

In the final fallback branch of direct API client construction, used when no gateway, Bedrock, or Vertex provider applies, the client config now sets baseURL to ANTHROPIC_BASE_URL when that environment variable is present. This replaces a prior unconditional no-op spread, so ANTHROPIC_BASE_URL is now respected in this fallback path.

The loopback/https hygiene check for bootstrap config, previously limited to single string URLs, now also inspects array-valued fields using a new helper that collects URLs from strings, arrays, and {url} objects. A new allowLoopbackResponseUrls setting can explicitly permit response URLs to point at loopback hosts.

A new otlpHeadersHelper setting points to an executable that prints a JSON object of collector headers on stdout. Its output is merged over the static otlpHeaders and the new auth-mode header, taking precedence, and is re-run periodically and on rotation for Code and Cowork sessions.

Gateway OIDC inference auth (access-token mode) supports a new resource subfield for setting an absolute HTTPS resource-indicator URL, sent on authorization, token, and refresh requests per RFC 8707. This lets the IdP audience-restrict the issued token to the gateway. It works with AD FS and other RFC 8707-compliant identity providers, but is explicitly not supported for Entra ID.

A new relaunchEnforcementHours setting controls how long a user can keep working on a stale config after the server pushes a change before the app forces a restart dialog. It defaults to 1 hour, is settable from 0 to 336 hours, and only takes effect when set via the remote bootstrap config; it is ignored if set via MDM.

A new relocateUncUserData setting (1p only) moves app data storage to local AppData when Windows Roaming AppData is redirected to a network share via a UNC path, since Cowork's VM sandbox can't mount network paths. Relocation starts fresh, with no existing data carried over.

allowedPluginMarketplaces entries can now set credentialKind: "inferenceCredential" for url-sourced marketplaces. This sends the same credential the app already uses for its inference gateway or bootstrap server, so a marketplace hosted on that same origin needs no separate credential setup.

The proactivityMenu:previousLevel, proactivityMenu:nextLevel, and proactivityMenu:dismiss bindable actions have been removed, leaving only proactivityMenu:previousMode and proactivityMenu:nextMode for cycling the proactivity menu.

WebFetch can now recognize when an artifact URL actually points to a file inside that artifact, and in that case it lists the files and saves the content locally instead of inlining it. If the referenced file can't be resolved, a dedicated error message is shown.

Artifact permission checks now distinguish files that come from an Artifact type the publisher authored from files published by a co-writer, using separate wording for each case. They also detect when a save path is nominally under the session scratchpad but a symlink there resolves outside the scratchpad carve-out; both new cases require user approval rather than classifier approval.

Deleting a background/fleet job whose worktree has unpushed commits no longer fails silently. It now reports the unpushed commit count and prompts you to delete again to discard them, tracking a discardOffer so a second delete forces discardUnpushed.

A new shared helper, credentialHeadersWarn, flags MCP server URLs/headers and inference custom headers that look like they leak plain-HTTP credentials or shared bearer tokens, with messages like "Endpoint is plain HTTP; auth credentials travel in cleartext" and "Shared bearer token: every org member authenticates as the same identity." It's applied to both managedMcpServers config and the inferenceCustomHeaders field.

The shared URL schema used for MCP server URLs and similar fields now rejects URLs containing embedded userinfo (user:pass@host), reporting a dedicated CREDENTIALED_URL_MESSAGE error. A new allowHttp option can be set on the schema to permit plain-http URLs beyond the existing loopback-http allowance.

autoUpdaterEnforcementHours now has a long description clarifying its behavior: it has no effect when disableAutoUpdates is set, since the updater never starts. Leaving it blank uses the 72-hour default and waits for at least 10 minutes of machine idle before restarting, whereas setting an explicit value, even 72, restarts once the window elapses regardless of activity. In both cases, restarts still hold off while Claude is mid-task.

The startup-timeout idle-detection window for self-hosted runner session children can now be set via the SELF_HOSTED_RUNNER_STARTUP_TIMEOUT_MS environment variable, in addition to the existing --startup-timeout-min CLI flag.

The /reload-plugins slash command can now be run in non-interactive (scripted/headless) sessions.