# Claude Code v2.1.260 > Claude Code v2.1.260, released 3 Sep 2026 (2026-09-03). 400 entries read out of the shipped bundle. Unofficial, and not affiliated with Anthropic. Web version: https://changelogs.core-directive.com/v/2.1.260 This build carries 42 gated entries, most not switched on. A hidden 'advisor' local command exists to let Claude consult a stronger model, but it stays off unless internal gates allow it, and a "Fable" model family sits wired into the model picker behind an entitlement check. A hidden CLAUDE_CODE_QUESTION_EXTENDED variable would enable an extended AskUserQuestion mode but defaults off, and artifact publishing can copy files between artifacts server-side, though the copy path can be switched off. Spawned subagents can now receive recent conversation context from the coordinator, and a "Precompute compaction" toggle appears in settings but only works once an internal gate is enabled. A new mode-resolution helper backs an unreleased "proactive" permission mode, and a fully built live collaborative whiteboard variant remains disabled at the code level. Of 211 shipped entries, published Artifacts can now declare the desktop app's own browser tools, like navigate and screenshot, as a built-in host server. Plugin agent.spawn hooks can deny or rewrite a subagent's type, prompt, model, or background flag before it launches, and plugin hook scripts gain a new $.process.run capability to spawn external commands. Fable 5.1 can now be reviewed and enabled by running /model fable, and tool permission rules can target specific arguments, such as Bash(curl *) or Read(**/secrets/**). The Usage page can show a per-model USD cost estimate when inferenceModelPricingEnabled is turned on, a new sshHostAllowlist setting lets admins restrict SSH hosts for remote Code sessions, and plugin panels above the prompt are now keyboard-navigable via ctrl+x ctrl+a. Among 41 fixes, the cd-then-read deny-rule circuit breaker, which warned before cd-ing into a directory covered by a Read deny rule, has been removed entirely, and the proactivity menu's level-cycling keybindings are gone. Rewinding a conversation now evicts cached file and memory reads for discarded messages and tracks files touched via Edit/Write/notebook calls, not just attachments, fixing stale re-reads. MCP server config changes now properly clean up removed or replaced clients instead of leaking them, and a rewind that fails to restore every changed file now throws an error rather than silently reporting success. ANTHROPIC_BASE_URL is now actually respected as the fallback baseURL in the last-resort direct API client path, and publishing an artifact now refuses if a local MCP server name would collide with the app's built-in server. ## What probably matters to you Anything you can use today, anything that visibly changes, and anything worth poking at. One line each, open for detail. ### Hidden 'fable' model surfaced only after an entitlement probe accepts A hidden Fable model only appears once a server-side entitlement probe accepts your account. The model-picker logic (`koe`) can now inject an extra model option into the list before the usual custom/alias handling. This is gated by `Iwt()`, which only returns true once an internal "fable entitlement probe" (tracked via `fableEntitlementProbeAccount` and `fableEntitlementProbeModel` in the provider cache) has reached an `"accepted"` state on the server; otherwise the option stays hidden. Related identifiers, including `claude-fable-` and the alias `fable51`, point to a codenamed model whose visibility depends on server-verified entitlement rather than any local flag. - Area: Models - Names: `fable51` - Tier: Nothing to try yet - Useful: 4/5 - Signal: 4/5 - Present in the build but not switched on ### New "Fable" model family wired into the model picker A new Fable model family is wired into the picker but gated behind an entitlement check. The model picker adds a "Fable" model family, listed with the description "Fable 5.1 · ...". Internally it references `claude-fable-` model identifiers and is gated by a new entitlement probe, `fableEntitlementProbe`. - Area: Models - Names: `fableEntitlementProbe` - Tier: Nothing to try yet - Useful: 4/5 - Signal: 4/5 - Present in the build but not switched on ### Live collaborative whiteboard variant built but disabled at the code level A live collaborative whiteboard variant exists in code but is disabled by internal gates. The whiteboard-artifact skill now has two full variants: the existing solo canvas, and a new live/collaborative one where everyone with the board open sees each other's strokes and cursors as they happen, the board shows whether a given session is present, and drawing can happen live alongside sending messages. Which variant loads is decided by `ze()`, which sets `whiteboardVariantLatch` to `"live"` only when both `Cbn()` and `Ele()` are true, otherwise `"solo"`. Separately, the whiteboard skill as a whole is only enabled when `Tbn()` and `fk()` both hold. - Area: Artifacts - Names: `whiteboardVariantLatch` - Tier: Nothing to try yet - Useful: 3/5 - Signal: 4/5 - Present in the build but not switched on ### New hidden 'advisor' local command A hidden advisor command exists but stays disabled unless two internal gates pass. A new hidden built-in command, `advisor` ("Let Claude consult a stronger model at key moments"), has been added, including non-interactive support and an argument hint listing available advisor models plus `off`. It stays hidden and disabled unless two internal gates both pass. - Area: Advisor - Names: `advisor` - Tier: Nothing to try yet - Useful: 3/5 - Signal: 4/5 - Present in the build but not switched on ### New `$.process.run` capability for plugin hook scripts Plugin hook scripts can now spawn and run external commands via $.process.run. Plugin hook scripts can now call `$.process.run` alongside the existing `fs.*`, `store.*`, and `http.fetch` namespace, letting a hook spawn and run arbitrary external commands rather than only reading files or making HTTP calls. The implementation validates arguments, handles SIGTERM-then-SIGKILL shutdown, caps captured stdout/stderr size, runs under `toolCgroupClass: "plugin"`, and applies default and maximum timeouts. - Area: Plugins - Tier: Use it now - Useful: 4/5 - Signal: 3/5 ### Plugin agent.spawn hooks can now rewrite or deny subagent launches Plugin hooks can now deny or rewrite subagent launches before they start. Plugin `agent.spawn` hooks can now intercept the Task tool's subagent-spawn path: a hook can deny a spawn outright, or rewrite its agent type, prompt, description, `cwd`, model, or background flag before launch. New guardrails accompany this: agents renamed by a hook get their MCP requirements rechecked, `cwd` changes are rejected when isolation is `worktree`, and a hook can't retarget an unconfined web-fetch dispatch to another agent without classifier review. - Area: Plugins - Names: `agent.spawn` - Tier: Under the hood - Useful: 4/5 - Signal: 3/5 ### Fable 5.1 advisor feature surfaced with setup prompt A new Fable 5.1 advisor model can be enabled by running /model fable. A new advisor option, Fable 5.1, can be reviewed and enabled by running `/model fable` (in an interactive terminal session if needed), after which it can be set as the advisor. - Area: Models - Names: `/model fable` - Tier: Use it now - Useful: 5/5 - Signal: 2/5 ### New SSH host allowlist for remote Code sessions Admins can now allowlist which SSH hosts users may connect to for remote Code sessions. A new managed-settings key, `sshHostAllowlist`, lets admins list SSH hosts (exact hostnames or `*.` wildcards) that users may connect to for Claude Code desktop sessions run over SSH; if it's unset or empty, the SSH option is hidden and connection attempts are refused. Allowed connections forward the session's inference credential, but only if it's token-based — file-based credentials such as Bedrock IAM Identity Center or Vertex creds are refused — along with the OTLP endpoint and auth headers. This is an opt-in beta feature. - Area: Sessions - Names: `sshHostAllowlist` - Tier: Use it now - Useful: 5/5 - Signal: 2/5 ### New per-model pricing estimate on Usage page The Usage page can now show estimated dollar cost per model, off unless you turn it on. The Usage page can now show a USD cost estimate per model, priced at Anthropic list price by default. It is controlled by a new `inferenceModelPricingEnabled` toggle (off unless explicitly enabled), and can be refined with `inferenceModelPricingMultiplier` and `inferenceModelPricing`, which sets per-model USD/Mtok rates for input, output, cache read, and cache write. - Area: Usage Page - Names: `inferenceModelPricingEnabled`, `inferenceModelPricingMultiplier`, `inferenceModelPricing` - Tier: Use it now - Useful: 5/5 - Signal: 2/5 ### New whiteboard artifact type A new whiteboard artifact lets Claude sketch diagrams with shapes, sticky notes, and live cursors. Claude can now create a whiteboard artifact: a live collaborative sketch canvas with boxes, databases, decision diamonds, sticky notes, arrows, freehand drawing, text, and pasted images, plus shared live cursors and strokes, intended for wireframe-style diagramming discussions. - Area: Artifacts - Tier: Use it now - Useful: 5/5 - Signal: 2/5 ### New 'bash-first steer' strictness setting (cozy teapot) An unreleased-sounding env var controls how strictly auto mode steers you toward bash. Auto-mode's bash-first steering behavior now has a configurable strictness setting, resolved from an env var and then org/user config, defaulting to `strict`. The resolved value is attached to the `auto_mode` payload as `bashFirstSteer` whenever bash-first mode is active. The env var involved is `CLAUDE_CODE_COZY_TEAPOT`. - Area: Auto Mode - Names: `CLAUDE_CODE_COZY_TEAPOT` - Tier: Nothing to try yet - Useful: 2/5 - Signal: 4/5 - Present in the build but not switched on ### "artifact endpoints are not available in this build" — build-gated capability Artifact endpoint actions exist in code but are refused as not available in this build. An artifact action set, `get_endpoints`, `call_endpoint`, and `run_script`, now checks a module-level variable before allowing use. When unset, permission is denied with the message "artifact endpoints are not available in this build," indicating the capability is compiled in but only enabled in certain builds. - Area: Artifacts - Names: `get_endpoints`, `call_endpoint` - Tier: Nothing to try yet - Useful: 3/5 - Signal: 3/5 - Present in the build but not switched on ### Artifact 'copy_from' capability added Copying assets between artifacts is built with UI toasts, gated behind capability flags. Artifacts now support copying another artifact's assets via `copy_from` in sessions where that capability is available. Where it isn't available, a new error message clarifies that `asset: true` can be used instead with a local `file_path`. A UI toast now reports "copied N asset(s) into the artifact" for `asset_copy` results, and new `frozenCopyFrom` / `frozenMultiFile` flags were added to artifact runtime state. - Area: Artifacts - Names: `copy_from`, `frozenCopyFrom`, `frozenMultiFile` - Tier: Nothing to try yet - Useful: 3/5 - Signal: 3/5 - Present in the build but not switched on ### Artifact assets: new copy_from action with dedicated error cases A copy_from action for copying assets between artifacts is built with its own error handling. The artifact tool now supports a `copy_from` action for copying assets between artifacts. Errors are reported with dedicated cases: a copy-specific `not_found` message that identifies the source artifact, a new `asset_not_found` case, and a new `not_copyable` case, and the permission checker's action allow-list now includes `copy_from`. - Area: Artifacts - Names: `copy_from`, `not_copyable` - Tier: Nothing to try yet - Useful: 3/5 - Signal: 3/5 - Present in the build but not switched on ### AskUserQuestion "extended" question mode gated by env var, off by default An extended question mode is gated behind an env var and off by default. Setting the `CLAUDE_CODE_QUESTION_EXTENDED` environment variable now enables an "extended questions" mode for the AskUserQuestion preview feature, via `host.launchOptions.replaceExtendedQuestionsEnabled(true)`. It only applies when the entrypoint is one of `sdk-ts`, `sdk-py`, `sdk-cli`, `local-agent`, `claude-desktop`, or `claude-desktop-3p`, or when the client type resolves to `remote`; it is off by default with no fallback-true case, and it is stripped from subprocess and MCP-child environments so it won't propagate. - Area: AskUserQuestion - Names: `CLAUDE_CODE_QUESTION_EXTENDED` - Tier: Nothing to try yet - Useful: 3/5 - Signal: 3/5 - Present in the build but not switched on ### Auto-drafted replies to artifact comment threads, gated off by default Claude can auto-draft replies to artifact comments, but it's off by default and declines by default. Claude Code can now auto-draft and post replies to comments on artifacts it can reach, guarded by a new permission rule for the pseudo-tool action `action:reply`, which can be persisted at session or userSettings scope. In ask mode, an unanswered request to reply now defaults to declining (`defaultToNo: true`) for non-subagent contexts. If you decline a drafted reply with feedback, the session records a system note quoting your reason and stops drafting further replies to that artifact's comments for the rest of the session. - Flag `tengu_ochre_plover`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Names: `action:reply` - Tier: Nothing to try yet - Useful: 3/5 - Signal: 3/5 - Present in the build but not switched on ### Extended (multi-type) AskUserQuestion questions behind a launch option Text and number question kinds are built, gated behind a launch option. `AskUserQuestion` now supports `text` and `number` question kinds in addition to multiple-choice. These kinds skip the requirement of at least 2 options, and validation errors for open-ended questions now suggest re-asking with `"kind": "text"` instead of demanding options. - Area: AskUserQuestion - Names: `kind: text`, `kind: number` - Tier: Nothing to try yet - Useful: 3/5 - Signal: 3/5 - Present in the build but not switched on ### New "proactive" permission-mode resolution A new proactive permission mode picks bypass or auto-accept mode based on context. A new mode-resolution helper picks which permission mode to switch to based on context: from `proactive` it chooses `bypassPermissions` if available, otherwise `auto` or `acceptEdits`; from `ask` or `default` it prefers `auto` mode when available. This appears to back a new auto-accept/proactive option in permission settings. - Area: Permissions - Names: `proactive` - Tier: Nothing to try yet - Useful: 3/5 - Signal: 3/5 - Present in the build but not switched on ### New usage-limit bucket "cinder_cove" tied to a product called "Cowork" A hidden usage bar for a one-time Cowork credit exists but stays hidden until the backend sends it. The usage-limits schema, parsed by the new `teo` zod schema, adds a `cinder_cove` field alongside the existing five_hour/seven_day buckets. When present in the parsed response, the settings UI renders it as a separate usage bar titled "Claude Code and Cowork credit," described as a one-time credit with an optional expiry drawn from `resets_at`. The bar stays hidden until the backend actually sends `cinder_cove`. - Area: Usage & Limits - Names: `cinder_cove` - Tier: Nothing to try yet - Useful: 3/5 - Signal: 3/5 - Present in the build but not switched on ### Runtime-controllable browser tool exposed to published Artifacts via a built-in host server Published artifacts can now declare Claude's own browser tools as a host MCP server. The Artifact tool's prompt text for host MCP servers now documents a built-in exception, `host:claude_browser`, which lets a published Artifact declare the Claude desktop app's own browser tools — `read_page`, `get_page_text`, `find`, `preview_start`, `navigate`, `computer`, and `form_input` — as a host server. Previously only user-configured local MCP servers could be declared this way. - Area: Artifacts - Names: `host:claude_browser` - Tier: Nothing to try yet - Useful: 3/5 - Signal: 3/5 ### Argument-scoped permission rules for built-in tool controls Permission rules can now target specific arguments like Bash(curl *) instead of whole tools. `builtinToolPolicy` and `disabledBuiltinTools` now accept argument-scoped rules like `Bash(curl *)` or `Read(**/secrets/**)`, not just bare tool names. New parsing and validation logic, `parseBuiltinRule` and `canonicalBuiltinRule`, backs this and warns on malformed entries. - Area: Permissions - Names: `builtinToolPolicy`, `disabledBuiltinTools` - Tier: Use it now - Useful: 4/5 - Signal: 2/5 ### Artifacts can now be created from published "Artifact types" (templates) Artifacts can now be started from published templates that keep a fixed type page. Publishing an Artifact can now pass a `type_url` to start a new Artifact from a published Artifact type (a template/starter), along with a title. The result is an ordinary private Artifact whose type page and files stay fixed while the rest remains editable. The publish tool description and the title-field help text were both updated to describe this. - Area: Artifacts - Names: `type_url` - Tier: Use it now - Useful: 4/5 - Signal: 2/5 ### AskUserQuestion tool gains typed answers and a follow-up mode Questions to you can now be free-text or numeric, and can chain into follow-up questions. The AskUserQuestion tool now supports question `kind` values beyond multi-select: `text` and `number`, with `min`/`max` validation for numeric answers. It also supports a `followUp` flag; when set, the tool's returned message tells the model to call the question tool again with follow-up questions that build on the given answers, rather than proceeding with the task. - Area: AskUserQuestion - Names: `followUp` - Tier: Use it now - Useful: 4/5 - Signal: 2/5 ### Claude.ai session import gains automatic background import and export features New settings enable automatic background import of old sessions and exporting your chats as a zip. Two new config fields extend Claude.ai session import: `automatic3pImport` lets organizations enable a one-time automatic background import of a computer's earlier third-party Claude sessions, and `exportEnabled` lets users export their chats, Cowork tasks, and Code sessions as a portable zip. Both are independent of the existing import-enable toggle. - Area: Session Import - Names: `automatic3pImport`, `exportEnabled` - Tier: Use it now - Useful: 4/5 - Signal: 2/5 ### New /background-style dialog to view and stop cloud background tasks A new dialog lets you view and stop your running cloud background tasks. A new `/background-style` dialog lists `remoteBackgroundTasks` running in the cloud session. Pressing `x` sends a `stop_task` control request, and the dialog shows a "stopping…" state along with error text if the stop fails. - Area: Cloud Sessions - Names: `/background-style` - Tier: Use it now - Useful: 4/5 - Signal: 2/5 ### New keyboard-navigable 'above prompt' plugin panel UI A new panel above the prompt lets plugins show buttons and inputs, toggled with a keybinding. A new collapsible panel above the input prompt, `AbovePrompt`/`AbovePromptInput`/`AbovePromptSelect`, lets plugins render buttons, inputs, and selects, navigable via tab, arrows, enter, and escape. Two new default key bindings were added: `ctrl+x ctrl+a` toggles the panel (`abovePrompt:toggle`) and `ctrl+x tab` focuses it. - Area: Plugins - Names: `abovePrompt:toggle` - Tier: Use it now - Useful: 4/5 - Signal: 2/5 ### New server-derived config key gates Claude in Chrome extension use A new server-controlled key governs whether Claude can drive your Chrome browser via the extension. A new config key, `claudeInChromeEnabled`, is set entirely by Anthropic's control plane from the org's Claude in Chrome admin setting, not by any local MDM or bootstrap config. It controls whether Cowork/Code sessions can drive the user's Chrome/Edge browser via the extension — navigating, reading the page, clicking, typing, and taking screenshots. Desktop and the extension pair via a signed identity check against the Anthropic API, this requires `isLocalDevMcpEnabled` to remain enabled, and it's available on macOS/Windows only. - Area: Chrome & Browser - Names: `claudeInChromeEnabled` - Tier: Use it now - Useful: 4/5 - Signal: 2/5 ### Artifacts tool gains a "copy_from" action, behind a new flag defaulting off The artifact copy_from action is gated behind a new flag that defaults off. The artifact tool's `copy_from` action is now gated by a new `Are()` capability check in addition to the existing `assets` capability, stored as `frozenCopyFrom`. The gate reads the `tengu_cobalt_plinth_samphire` flag, which is new to this build, so the action's enum entry and description only appear when both checks pass. The artifacts tool's permission-check dispatcher recognizes the new `copy_from` action, letting Claude copy assets from one published artifact into another server-side, but the action is also guarded by an account-level check that currently resolves to disabled: calling it returns an explicit "action `copy_from` is not enabled for this account" error. - Flag `tengu_cobalt_plinth_samphire`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Names: `tengu_cobalt_plinth_samphire` - Tier: Nothing to try yet - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### Auto-mode 'bash-first' system-prompt wording is A/B'd behind a remote gate, falling back to the strict wording A remotely gated A/B test can loosen the bash-first system prompt wording. When auto/bypass mode qualifies for "bash-first" steering, mode metadata now carries `bashFirstSteer: Y7n()`. `Y7n()` resolves `CLAUDE_CODE_COZY_TEAPOT`, then a remote-settings/local-config lookup keyed by `tengu_cozy_teapot`, falling back to the literal `"strict"` if nothing is set. When `bashFirstSteer` resolves to `"relaxed"`, a looser system prompt is used ("The choice is yours: prefer Edit or Write when a shell edit would be fragile...") in place of the default stricter prompt that pushes almost everything through Bash. - Area: Auto Mode - Names: `CLAUDE_CODE_COZY_TEAPOT`, `tengu_cozy_teapot` - Tier: Nothing to try yet - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### Decoy "enable claude-in-chrome" tool, live only in a specific remote session profile A decoy tool tells the model browser tools already exist, only active in a specific remote session profile. A new tool, `enable__mcp__claude-in-chrome` (with a generic `Browser` variant), does nothing but tell the model that browser tools are already available under names containing `Claude_Browser`, or to use `claude-in-chrome`/`Claude_in_Chrome` tools directly, so the model stops trying to invoke a non-existent "enable" step. It only registers when the session runs under a CCR session profile, requiring `CCR_SESSION_PROFILE`, a valid `SESSION_INGRESS_URL`, a `CLAUDE_CODE_REMOTE_SESSION_ID` matching the `cse_...` pattern, and a first-party check; outside that remote/cloud profile the tool is not registered at all. - Area: Chrome & Browser - Names: `enable__mcp__claude-in-chrome`, `CCR_SESSION_PROFILE` - Tier: Nothing to try yet - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### Fable/fast-model eligibility gained a second unlock path tied to an entitlement probe Fable eligibility now has a second unlock path via a cached entitlement probe result. Fable/fast-model eligibility now has a second unlock path based on a cached `fableEntitlementProbe` acceptance result tied to the current account, in addition to the existing provider-list check. A session can become fable-eligible purely from this probe's cached "accepted" state even when the existing provider-list check fails. - Area: Models - Names: `fableEntitlementProbe` - Tier: Nothing to try yet - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### New "thinking strip" gate for adaptive reasoning: tengu_wise_comet A gated experiment controls whether adaptive thinking content gets stripped from output. A new experiment, `tengu_wise_comet`, controls whether the CLI strips extended-thinking content, but only applies when the thinking type is "adaptive"; other thinking types force stripping off. An env var override, `CLAUDE_CODE_WISE_COMET`, is also available. - Flag `tengu_wise_comet`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: no gate table built for this version) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Thinking Mode - Names: `CLAUDE_CODE_WISE_COMET`, `tengu_wise_comet` - Tier: Nothing to try yet - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### New CLI subcommand: forward-home-settings A new hidden CLI subcommand, forward-home-settings, has appeared with unclear purpose. A new CLI subcommand `forward-home-settings` is now recognized, joining the existing install/update/rollback and update/upgrade/doctor verbs. - Area: CLI - Names: `forward-home-settings` - Tier: Nothing to try yet - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### Per-model 'quizzical shore' hint on thinking blocks, off by default A hidden hint can appear on thinking blocks per model, off by default. The thinking-block renderer for assistant messages now takes a model prop and, for string models, checks a `quizzical_shore` experiment via a capability-logging helper, falling back to the `tengu_quizzical_shore` gate. When either resolves false, a hint node is shown alongside the trimmed thinking text. The message's model (`X.message.model`) is now threaded into the renderer specifically to support this check. - Flag `tengu_quizzical_shore`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Thinking Mode - Names: `tengu_quizzical_shore` - Tier: Nothing to try yet - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### 1M-context variant can now be the default picker selection A new setting can make the model picker default to the 1M-context model variant. A new `modelPrefer1mContext` config, along with a per-model `prefer1m` field, makes the model picker start on the 1M-context variant of the default model for users who have no saved selection, instead of always defaulting to the standard context window. - Area: Models - Names: `modelPrefer1mContext`, `prefer1m` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Adaptive thinking has an opt-out for specific models, unresolved by default Adaptive thinking is now default; an env var can revert to the old mode for certain models. Adaptive thinking mode is now the shipped default for per-turn thinking behavior. Setting `CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING` forces the older `enabled` mode instead, but only when the canonical model name includes `opus-4-6` or `sonnet-4-6`; otherwise adaptive mode applies as normal. - Area: Thinking Mode - Names: `CLAUDE_CODE_DISABLE_ADAPTIVE_THINKING` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Artifact asset store gains a server-side copy_from action Artifact assets can now be copied server-side between artifacts without downloading them. The artifact tool's asset store now supports a `copy_from` action that copies assets from one artifact into another entirely server-side, with no download or re-upload. It takes a destination `url`, a source `from_url`, and up to ten `asset_ids`, and requires the requesting session's approvals to cover the copied files ("files: copying another artifact's file needs the user's approval"). Reading an artifact's assets now also covers server-side copies of them into other artifacts. - Flag `tengu_cobalt_plinth_bracken`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Flag `tengu_cobalt_plinth_samphire`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Names: `copy_from` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Asset copy action added to artifact/asset system Artifacts gain a copy action for copying assets between artifacts. Artifacts and assets gain a copy action, exposed as `asset_copy` and `copy_from` in the action lists, along with new error kinds `not_found`, `asset_not_found`, and `not_copyable` for when a copy fails. - Area: Artifacts - Names: `asset_copy`, `copy_from` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Cloud session init frames now report live connection state and tool-call activity Cloud session init now reports live connection state and which tool calls are in flight. The `cloud_session` field on stream-json init frames, used by cloud-hosted and Remote Control sessions, gains a `connection` state (`connecting`, `live`, `reconnecting`) and a `calls` list of live and recent tool calls served to the cloud session, tracked by id and tool name only, pushed incrementally via `cloud_session_delta` frames. This lets a desktop or SDK host show whether its bridge to a cloud session is up and which tool calls are in flight or recently finished, without exposing call input or output. - Area: Cloud Sessions - Names: `cloud_session_delta` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Remote Control machine-profile sharing setting A new setting controls how much machine info Remote Control shares when it registers a device. A new `remoteControl.shareHostProfile` setting controls what a Remote Control environment learns about the local machine when it registers. `off` reports nothing, `basic` reports OS/architecture/dev tools, and `full` also reports configured MCP server names (never the contents of a repo's `.mcp.json`). If left unset, the level falls back to remote rollout config. Managed settings, `--settings`, and user settings combine to the most restrictive value among them, while project and local settings can only lower the level further, never raise it. - Flag `tengu_bridge_host_profile`: Not enough to say (read for one account on one subscription tier against v2.1.260; this account: no value returned, anonymous baseline: no value returned, compiled default: no gate table built for this version) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Remote Control - Names: `remoteControl.shareHostProfile` - Tier: Use it now - Useful: 3/5 - Signal: 2/5 ### Bash approvals can now auto-add a standing allow rule Approving some Bash commands can now silently save a standing allow rule for next time. Approving certain Bash calls can now silently create a persistent local allow rule. When `keepsStandingApprovals` is set on the input and the command is a clean, non-wildcard, single-line string under a length cap, the approval emits an `addRules` action that allows that exact command in `localSettings`. - Area: Permissions - Names: `keepsStandingApprovals` - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### New organizationInstructions managed setting Admins can now append custom free-text guidance to the system prompt org-wide. A new `organizationInstructions` managed setting lets admins configure free-text guidance, up to 3000 characters, that Claude Desktop appends to the system prompt in Chat, Cowork, and Code sessions. It is described as guidance the model follows rather than an enforced control. - Area: Admin Settings - Names: `organizationInstructions` - Tier: Use it now - Useful: 4/5 - Signal: 1/5 ### Footer hint line gains a 'proactivity' pill/level indicator The footer hint line can now show a proactivity level indicator. The footer hint line near the input area can now show a proactivity indicator, driven by new `proactivityLevelStepped` and `proactivityPillCollapsed` props that control a level pill and whether it's collapsed. - Area: Elsewhere - Names: `proactivityLevelStepped`, `proactivityPillCollapsed` - Tier: Use it now - Useful: 2/5 - Signal: 2/5 ### Desktop extension legacy key names now have a deprecation sunset Old desktop-extension setting names are deprecated with a sunset date; update configs before Oct 7. The deprecated legacy flat-key aliases `isDxtEnabled` and `isDxtDirectoryEnabled` now carry explicit deprecation metadata: warnings start 2026-09-10 and support ends 2026-10-07. After support ends, the old names will be reported as unreadable, which will cause desktop extensions to read as disabled (`isDxtEnabled`) or the directory-only restriction to silently stop applying (`isDxtDirectoryEnabled`), so configs using these names should be updated before then. - Area: Admin Settings - Names: `isDxtEnabled`, `isDxtDirectoryEnabled` - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 - Present in the build but not switched on ### Unsandboxed shell dispatch gains user-typed override path Unsandboxed shell commands are now also allowed when explicitly user-typed. Unsandboxed shell command dispatch is now also permitted when the request has `userTypedShellDispatch` explicitly set to `true`, in addition to the existing `areUnsandboxedCommandsAllowed()` check. - Area: Sandbox - Names: `userTypedShellDispatch` - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Precompute-compaction setting still gated off by default A precompute-compaction toggle is gated off by default and has no effect even if saved. The new "Precompute compaction" settings toggle (`precomputeCompactionEnabled`) only appears in the settings list when the `tengu_sepia_moth` gate resolves true. The feature's own gate function independently re-checks `tengu_sepia_moth` before consulting the stored setting value, so a saved preference has no effect unless the gate is enabled. - Flag `tengu_sepia_moth`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Compaction - Names: `precomputeCompactionEnabled`, `tengu_sepia_moth` - Tier: Nothing to try yet - Useful: 2/5 - Signal: 2/5 - Present in the build but not switched on ### Credential-helper scripts now receive a context environment variable Credential helper scripts now get a context variable telling them why they're being called. Custom credential helper scripts now receive a `CLAUDE_HELPER_CONTEXT` environment variable, with values such as `interactive`, `mid-session-refresh`, `background`, `scheduled-task`, and `setup-test`. Helpers can use this to decide whether it's safe to prompt the user interactively. - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### `claude rm` can now force-discard unpushed commits claude rm can now force-delete a worktree with unpushed commits using a new flag. `claude rm ` gains a `--discard-unpushed @` option to delete a background session's worktree even when it has unpushed commits or uncommitted changes, provided the worktree is still at the commit last reported. When `claude rm` refuses to delete a worktree with unpushed work, it now reports the exact `@` value to pass to this new flag. - Area: Sessions - Names: `claude rm` - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ### Admin toggles for user-added plugins/marketplaces Admins can now block users from adding their own plugin marketplaces or uploading plugins. Two new settings let an org lock down plugin extensibility in third-party mode. `userPluginMarketplacesEnabled`, on by default, controls whether users can add their own plugin marketplaces. `userPluginUploadsEnabled`, also on by default, controls whether users can upload or create their own plugins. Turning either off hides the corresponding in-app add surfaces and refuses adds that still reach the app. - Area: Plugins - Names: `userPluginMarketplacesEnabled`, `userPluginUploadsEnabled` - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ### AskUserQuestion tool gains richer question types and a 'more questions' path Questions can now be free text or numeric, and follow-ups are preferred over Other/Skip options. The `AskUserQuestion` tool's question schema now supports `"kind": "text"` for an open text box and `"kind": "number"` (with `min`, `max`, `step`, `defaultValue`, and `unit`) in addition to the existing option-based questions. Guidance now also steers away from adding 'Other' or 'Skip' options and instead encourages asking follow-up questions when the user wants more. - Area: AskUserQuestion - Names: `kind: text`, `kind: number` - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ### Bootstrap config request headers Bootstrap config fetches can now require auth headers via a static or helper-script setting. Two new settings let a bootstrap config server require authentication on its config fetch: `bootstrapHeaders` for static headers, and `bootstrapHeadersHelper` for an executable that prints headers as JSON, with its output cached for a few minutes. This supports a service-account credential or rotating token without embedding `user:pass@` in the URL. - Area: Bootstrap Config - Names: `bootstrapHeaders`, `bootstrapHeadersHelper` - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ### Cloud/remote sessions get a read-only Skills dialog Cloud sessions now show a read-only dialog listing which skills that session loaded. Connected cloud/remote sessions now expose a read-only Skills dialog listing the skills that session reported as loaded, distinguishing "no skills loaded" from "hasn't reported yet." Per-skill toggles still have to be changed in a local session; `/reload-skills` re-scans the cloud session's skill folders. A companion read-only `/memory`-style dialog shows the memory files (CLAUDE.md etc.) loaded in a connected cloud/teleported session, separating files sent from the local machine at launch from files that only exist in the cloud session's own `~/.claude`; local editing is blocked with an explanatory message. A new Permissions settings panel (Allow/Ask/Deny/Workspace tabs) displays the allow/ask/deny/`additionalDirectories` rules from a connected cloud session's settings files, fetched via a new `get_settings` control request. It's explicitly read-only: local `/permissions` edits don't apply to the cloud session. - Area: Skills - Names: `/reload-skills` - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ### Gateway/Vertex Workforce sign-in can use OS identity broker instead of browser Sign-in for gateway/Vertex can now route through the OS identity broker instead of a browser. A new `authFlow` setting for `inferenceGatewayOidc` and `inferenceVertexWorkforceOidc` (flat key `inferenceGatewayOidcAuthFlow`) chooses between `browser` and `broker` sign-in. The `broker` option routes sign-in through the OS identity broker (Windows Web Account Manager or macOS Company Portal) instead of a system browser, but requires the IdP to be Microsoft Entra ID and is not supported on Linux. - Area: Auth - Names: `inferenceGatewayOidcAuthFlow` - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ### New `disableAutoMode` permission/settings key A new setting can turn off Claude Code's auto mode entirely. A new settings key `disableAutoMode` (settable at top level or nested under `permissions.disableAutoMode`) turns off Claude Code's auto mode when set to `"disable"`, logging "auto mode disabled: disableAutoMode in settings". It merges through the same managed-settings logic as `disableBypassPermissionsMode`. - Area: Permissions - Names: `disableAutoMode` - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ### New admin config key: mcpToolTimeoutSec caps MCP tool call duration Admins can now cap how long MCP tool calls are allowed to run. A new managed-config field, `mcpToolTimeoutSec`, lets an org set a per-call timeout of 60-3600 seconds for MCP tool calls. Cowork/chat already defaulted to 180s, but Code sessions previously had no desktop-imposed MCP timeout; setting this key now gives them one, and the desktop's own request deadlines toward managed and user-added local MCP servers follow this value. - Area: MCP - Names: `mcpToolTimeoutSec` - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ### New permission setting groups: Tools, Code surface, Updates Desktop settings gain new grouped categories: Tools, Code surface, and Updates. Desktop config settings gained three new permission-group categories: `TOOLS_GROUP` (built-in tool restrictions and on-demand MCP tool loading), `CODE_SURFACE_GROUP` (settings for Code sessions, applying only while Code is enabled), and `UPDATES_GROUP`, joining the existing General restrictions, Anthropic telemetry, MCP servers, and Bootstrap groups. - Area: Admin Settings - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ### New plugin dev-mode hot reload with a reload-storm circuit breaker Plugin dev mode now hot-reloads on file changes, with a circuit breaker for rapid reload loops. Plugin dev mode now watches plugin directories and automatically reloads a plugin, or its hooks module, when relevant files change, debouncing rapid successive changes. If a plugin reloads more than a configured number of times in quick succession, reloading pauses and the user is told the latest save will load once the directory is quiet, or that they can run `/reload-plugins` to reload immediately. - Area: Plugins - Names: `/reload-plugins` - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ### New plugin-authoring skill for function-hooks plugins A new bundled skill teaches how to write function-hook plugins. A new bundled skill teaches how to write or debug a Claude Code plugin built from function hooks, covering `register(on, options)` and hooks on `tool.call`, `prompt.submit`, `ui.render`, `session.start`, and similar events. - Area: Plugins - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ### New skipWebFetchPreflight setting A new setting skips WebFetch's safety check against api.anthropic.com for firewalled deployments. A new `skipWebFetchPreflight` setting skips Claude Code's `WebFetch` domain-safety lookup against `api.anthropic.com` in Code sessions, useful when that host is firewalled off in third-party deployments. - Area: WebFetch - Names: `skipWebFetchPreflight` - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ### OTLP exporter can reuse the inference credential OTLP exports can now reuse your inference credential for authentication instead of static headers. A new `otlpAuthMode` setting lets OTLP collector authentication reuse the signed-in inference credential, sending it as `Authorization: Bearer ` on OTLP exports instead of relying only on static headers. - Area: Telemetry - Names: `otlpAuthMode` - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ### Plugin UI toolkit gains Button/Input/Select/Link element support Plugin UIs can now render interactive Button, Input, Select, and Link elements. Plugins can now render `Button`, `Input`, `Select`, and `Link` elements in the desktop/terminal UI, in addition to the previously supported `Box`, `Text`, `div`, `span`, `b`, and `Svg`. Press-wrapping dispatch logic now also handles `Input` and `Select`, not just `Button`, giving plugin UIs interactive form-style controls. - Area: Plugins - Names: `Button`, `Input`, `Select`, `Link` - Tier: Use it now - Useful: 3/5 - Signal: 1/5 ### Credential-shaped header names/values now flagged in connector/hook config Connector/hook config is now scanned for credential-shaped values and warns you to use a helper script. Connector and hook config is now scanned for credential-shaped header names (like `Authorization`, `Cookie`, or `X-API-Key`-style patterns) or values that look like bearer tokens, JWTs, AWS access keys, or common vendor secret formats (`sk-`, `ghp_`, `AIza`, `GOCSPX-`, `glpat-`, and others). When found, Claude Code warns you to use a headers/credential helper script instead of storing the secret directly in the config file. - Area: Permissions - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### --watch-artifact now accepts a short/base58 artifact id directly --watch-artifact now accepts a short base58 artifact id directly, not just a full URL. The `--watch-artifact` CLI flag now accepts a short, base58-style artifact id directly, decoding it into a full artifact slug before falling back to the existing slug-regex or URL parsing. Previously only a full slug or a claude.ai artifact URL was accepted. - Area: CLI - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### Artifact publish supports copying files from other artifacts Publishing an artifact can now copy in files from other artifacts. The artifact publish tool now accepts a `copiedFiles` list, letting a publish operation copy files in from other artifacts. The response echoes these back under `copied`, with `from_url` and `from_path` for each copied file. - Area: Artifacts - Names: `copiedFiles` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### Artifact tool renames get_handlers/call_handler to get_endpoints/call_endpoint Artifact tool renames handler actions to endpoints and adds a copy_from action. The built-in artifact/site tool's `get_handlers` and `call_handler` actions have been renamed to `get_endpoints` and `call_endpoint`. A new `copy_from` action has also been added alongside the existing `list_files`, `read_file`, and `delete` actions, for copying assets between artifacts. - Area: Artifacts - Names: `get_endpoints`, `call_endpoint`, `copy_from` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### Artifact-type instantiation now requires a title, and store-backed types get their own fill guidance Starting an artifact from a published type now requires a title. Starting a new Artifact from a published type now requires passing a `title` (what the user called it, or a short descriptive name) alongside `type_url`, in addition to the type's own instructions being returned. The tool description was also reworded to distinguish types filled through their own data store from ones filled with page/data files: for store-backed types, the model should call the store-write path or `run_script` rather than publish files. - Area: Artifacts - Names: `type_url` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### Built-in web search can now be disabled or gated via policy without host list WebSearch can now be disabled or gated entirely without needing a host list. The built-in `WebSearch` tool can now be disabled entirely or gated behind per-search approval by listing the bare `WebSearch` name (no per-host scope) in `disabledBuiltinTools` or `builtinToolPolicy`. - Area: Elsewhere - Names: `disabledBuiltinTools`, `builtinToolPolicy`, `WebSearch` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### Claude Gateway OIDC config gains scope_on_refresh option Gateway OIDC config gains an option to control whether scope resends on token refresh. The gateway's OIDC config schema gains a `scope_on_refresh` boolean option, sitting alongside existing settings like `use_pkce` and `userinfo_fallback`, to control whether scope is resent when a token is refreshed. - Area: Auth - Names: `scope_on_refresh` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### Cloud session plugin visibility panel A new panel shows which plugins a connected cloud session has loaded. A new plugins-management view shows which plugins a connected cloud session loaded, or notes that it hasn't reported yet, and explains how local plugin changes propagate to that session via `/cloud-plugins` or `/reload-plugins`. - Area: Plugins - Names: `/cloud-plugins`, `/reload-plugins` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### Diff dialog gains a fullscreen presentation mode The diff dialog now explicitly distinguishes a fullscreen mode from the sidebar view. The diff view now decides between the sidebar diff UI and the full `DiffDialog` based on an explicit `presentation === "fullscreen"` flag, rather than inferring it from other state. The `/diff` command's immediate-availability check and description text were updated to match this new fullscreen distinction, and the contextual notification hinting at enabling tmux mouse support is now shown only when presentation mode is `fullscreen`. - Area: Diff View - Names: `/diff` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### Direct API client construction now respects ANTHROPIC_BASE_URL as a fallback baseURL ANTHROPIC_BASE_URL is now actually respected in the direct-API fallback path. In the final fallback branch of direct API client construction, used when no gateway, Bedrock, or Vertex provider applies, the client config now sets `baseURL` to `ANTHROPIC_BASE_URL` when that environment variable is present. This replaces a prior unconditional no-op spread, so `ANTHROPIC_BASE_URL` is now respected in this fallback path. - Area: API Configuration - Names: `ANTHROPIC_BASE_URL` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### Job deletion can discard confirmed unpushed worktree commits Background job worktree deletion can now discard confirmed unpushed commits with a re-confirm step. Deleting a background job's worktree used to be refused outright if it held commits not pushed to any remote. Now a caller can pass a `discardUnpushed` pin (`headSha` plus `worktreeDigest`), and if the worktree's HEAD still matches that pin, the removal goes through despite the unpushed commits. If HEAD has moved since the pin was taken, or the unpushed commits are also referenced by another job's state (the new `unpushed_shared` case), the deletion is refused again with kept-worktree reason `unpushed` or `unpushed_shared`, along with `keptUnpushed`/`discardUnpushed` info so the caller can re-confirm and retry. - Area: Sessions - Names: `discardUnpushed` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### Loopback/non-https URL rejection widened to array-valued bootstrap fields URL safety checks now cover list-valued config fields, with a new setting to allow loopback response URLs. The loopback/https hygiene check for bootstrap config, previously limited to single string URLs, now also inspects array-valued fields using a new helper that collects URLs from strings, arrays, and `{url}` objects. A new `allowLoopbackResponseUrls` setting can explicitly permit response URLs to point at loopback hosts. - Area: Bootstrap Config - Names: `allowLoopbackResponseUrls` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### New OTLP headers helper script support OTLP collector headers can now come from a helper script that's re-run periodically. A new `otlpHeadersHelper` setting points to an executable that prints a JSON object of collector headers on stdout. Its output is merged over the static `otlpHeaders` and the new auth-mode header, taking precedence, and is re-run periodically and on rotation for Code and Cowork sessions. - Area: Telemetry - Names: `otlpHeadersHelper` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### New RFC 8707 resource-indicator field for gateway OIDC inference auth Gateway OIDC auth can now send an RFC 8707 resource-indicator URL to audience-restrict tokens. Gateway OIDC inference auth (access-token mode) supports a new `resource` subfield for setting an absolute HTTPS resource-indicator URL, sent on authorization, token, and refresh requests per RFC 8707. This lets the IdP audience-restrict the issued token to the gateway. It works with AD FS and other RFC 8707-compliant identity providers, but is explicitly not supported for Entra ID. - Area: Auth - Names: `resource` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### New relaunch-window control for served config changes A new setting controls how long you can keep working on stale config before a forced restart. A new `relaunchEnforcementHours` setting controls how long a user can keep working on a stale config after the server pushes a change before the app forces a restart dialog. It defaults to 1 hour, is settable from 0 to 336 hours, and only takes effect when set via the remote bootstrap config; it is ignored if set via MDM. - Area: Admin Settings - Names: `relaunchEnforcementHours` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### New relocateUncUserData setting (1p only) A new setting relocates app data storage when Windows AppData is on a network share. A new `relocateUncUserData` setting (1p only) moves app data storage to local AppData when Windows Roaming AppData is redirected to a network share via a UNC path, since Cowork's VM sandbox can't mount network paths. Relocation starts fresh, with no existing data carried over. - Area: Elsewhere - Names: `relocateUncUserData` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### Plugin marketplaces gain an inference-credential auth mode Plugin marketplaces can now authenticate using the app's existing inference credential. `allowedPluginMarketplaces` entries can now set `credentialKind: "inferenceCredential"` for `url`-sourced marketplaces. This sends the same credential the app already uses for its inference gateway or bootstrap server, so a marketplace hosted on that same origin needs no separate credential setup. - Area: Plugins - Names: `credentialKind` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### Proactivity menu level-cycling keybindings removed Proactivity menu level-cycling keybindings were removed, leaving only mode-cycling. The `proactivityMenu:previousLevel`, `proactivityMenu:nextLevel`, and `proactivityMenu:dismiss` bindable actions have been removed, leaving only `proactivityMenu:previousMode` and `proactivityMenu:nextMode` for cycling the proactivity menu. - Area: Terminal UI - Names: `proactivityMenu:previousMode`, `proactivityMenu:nextMode` - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### WebFetch artifact tool can now resolve file paths inside an artifact URL WebFetch can now resolve a file path inside an artifact URL and save it locally. WebFetch can now recognize when an artifact URL actually points to a file inside that artifact, and in that case it lists the files and saves the content locally instead of inlining it. If the referenced file can't be resolved, a dedicated error message is shown. - Area: WebFetch - Tier: Use it now - Useful: 2/5 - Signal: 1/5 ### Artifact permission checks extended to Artifact-type-authored files and scratchpad symlink escapes Artifact permission checks now catch type-authored files and symlink escapes out of the scratchpad. Artifact permission checks now distinguish files that come from an Artifact type the publisher authored from files published by a co-writer, using separate wording for each case. They also detect when a save path is nominally under the session scratchpad but a symlink there resolves outside the scratchpad carve-out; both new cases require user approval rather than classifier approval. - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### New 'stalled_unsent' outcome for remote tool approvals Deleting a job with unpushed commits now tells you the count and lets a second delete force discard. Deleting a background/fleet job whose worktree has unpushed commits no longer fails silently. It now reports the unpushed commit count and prompts you to delete again to discard them, tracking a `discardOffer` so a second delete forces `discardUnpushed`. - Area: Sessions - Names: `discardUnpushed` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### New credential-header safety warning for MCP config and inference headers MCP and inference config now warn when headers look like they leak credentials over plain HTTP or shared tokens. A new shared helper, `credentialHeadersWarn`, flags MCP server URLs/headers and inference custom headers that look like they leak plain-HTTP credentials or shared bearer tokens, with messages like "Endpoint is plain HTTP; auth credentials travel in cleartext" and "Shared bearer token: every org member authenticates as the same identity." It's applied to both `managedMcpServers` config and the `inferenceCustomHeaders` field. - Area: Permissions - Names: `credentialHeadersWarn` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### URL schema now rejects credentialed URLs and gained an allowHttp option MCP server URLs with embedded credentials are now rejected, and plain-http can be explicitly allowed. The shared URL schema used for MCP server URLs and similar fields now rejects URLs containing embedded userinfo (`user:pass@host`), reporting a dedicated `CREDENTIALED_URL_MESSAGE` error. A new `allowHttp` option can be set on the schema to permit plain-http URLs beyond the existing loopback-http allowance. - Area: MCP - Names: `allowHttp` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Auto-update enforcement window: documented idle-wait behavior and interaction with disableAutoUpdates Auto-update enforcement docs now clarify idle-wait and restart behavior in detail. `autoUpdaterEnforcementHours` now has a long description clarifying its behavior: it has no effect when `disableAutoUpdates` is set, since the updater never starts. Leaving it blank uses the 72-hour default and waits for at least 10 minutes of machine idle before restarting, whereas setting an explicit value, even 72, restarts once the window elapses regardless of activity. In both cases, restarts still hold off while Claude is mid-task. - Area: Elsewhere - Names: `autoUpdaterEnforcementHours` - Tier: Use it now - Useful: 1/5 - Signal: 1/5 ### New env var to configure self-hosted runner session startup timeout Runner session startup timeout can now be set via an environment variable too. The startup-timeout idle-detection window for self-hosted runner session children can now be set via the `SELF_HOSTED_RUNNER_STARTUP_TIMEOUT_MS` environment variable, in addition to the existing `--startup-timeout-min` CLI flag. - Area: Self-Hosted Runner - Names: `SELF_HOSTED_RUNNER_STARTUP_TIMEOUT_MS` - Tier: Use it now - Useful: 1/5 - Signal: 1/5 ### New top-level `disableAutoMode` setting Admins get a simpler top-level way to disable Auto mode without nesting the setting. A top-level `disableAutoMode: 'disable'` setting is now recognized, giving admins a simpler managed-settings path to disable Auto mode instead of requiring it to be nested under `permissions.disableAutoMode`. - Area: Permissions - Names: `disableAutoMode` - Tier: Use it now - Useful: 1/5 - Signal: 1/5 ### reload-plugins command now works non-interactively /reload-plugins now works in non-interactive/headless sessions. The `/reload-plugins` slash command can now be run in non-interactive (scripted/headless) sessions. - Area: Plugins - Names: `/reload-plugins` - Tier: Use it now - Useful: 1/5 - Signal: 1/5 ## New Features ### New "hosted" OAuth mode for MCP servers MCP servers gain a hosted OAuth mode using Anthropic-managed client identity. `McpOauth` gains a third mode, `hosted`, alongside `dcr` and `byo`: an Anthropic-hosted client identity that requires Claude.ai sign-in, where `clientId` is set by the Claude.ai control plane rather than authored by the admin. - Area: MCP - Names: `hosted` - Tier: Under the hood - Useful: 3/5 - Signal: 2/5 ### New declarative Input/Select/Link UI primitives for plugins Plugins gain validated Input, Select, and Link UI components. The plugin-facing UI framework gains validated `Input`, `Select`, and `Link` component types: `Input` enforces character limits and control-character checks, `Select` requires unique option values and detects duplicate keys, and `Link` validates its `href` as a canonical URL. On the terminal side, new `ui.input` and `ui.select` events dispatch to handlers, logging timing and settling handler chains. - Area: Plugins - Names: `ui.input`, `ui.select` - Tier: Nothing to try yet - Useful: 3/5 - Signal: 2/5 ### Artifact publish can now attach a live subscription and arming transcript Publishing from a type can now attach a live subscription for live-updating artifacts. The create-from-type artifact publish path now computes a `liveSubscription` and an arming transcript via a new helper, and includes `liveSubscription` in the response data when present, indicating support for live-updating artifacts created from a type. - Area: Artifacts - Names: `liveSubscription` - Tier: Nothing to try yet - Useful: 2/5 - Signal: 2/5 ## Improvements ### Managed MCP server config gets a formal deprecation/migration system Legacy managed MCP server config fields now have a formal deprecation and rewrite system. A new deprecation system now governs legacy forms in `managedMcpServers[]` entries. Old-style fields like an `oauth.scopes` list, a `toolPolicy` of `"ask-session"`, `transport:"builtin"`, and `authorityHost` are each mapped to a rewrite rule with a defined support window; once support ends, an entry still in the old form is rejected outright and that connector becomes unavailable until rewritten. `authorityHost` support has already ended: it is now rejected with the message `authorityHost was removed: set azureCloud ("us-gov-high" for GCC High) instead`. - Area: MCP - Names: `authorityHost`, `azureCloud` - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### Session runner: max-lifetime handling can now hand off to a poll-loop 'release' instead of hard-terminating Sessions hitting max lifetime can now be released via a poll-loop instead of always hard-terminated. When a session hits its max lifetime, the session runner now distinguishes three outcomes: releasing immediately if not mid-turn, waiting for the in-flight turn to "park or finish" and then releasing if a hook decided the release, or falling back to the old hard-terminate path. Hard termination now only happens if the in-flight turn's release isn't accepted within the grace window. - Area: Sessions - Tier: Under the hood - Useful: 3/5 - Signal: 2/5 ### New authorship tiers for messages relayed into a session from Slack/Teams Messages relayed from Slack/Teams now carry authorship tiers affecting how much trust they get. Messages relayed into a session from Slack or Teams now carry one of three authorship tiers. `session-user` marks turns typed directly, with full standing. `channel-participant` marks turns relayed from a bound Slack, Teams, or shared-project channel, carrying the same standing as a same-session user message for that one action. `unattributed` marks background messages with no consent, and is treated accordingly. The prompt-construction functions building this section, `Zts` and `Jts`, are called from the live prompt-assembly path. - Area: Slack/Teams Integration - Tier: Under the hood - Useful: 3/5 - Signal: 2/5 ### Web-fetch agent retype via spawn hook is blocked without classifier review Spawn hooks can no longer redirect a web-fetch to an unconfined agent without classifier review. A plugin's `agent.spawn` hook can no longer redirect a web-fetch tool dispatch to a different, unconfined agent unless it goes through classifier review; otherwise the spawn is blocked with an error that it cannot run unconfined without that review. - Area: Plugins - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Artifact list/read results can report 'cowritten' status Artifact reads can now report when content was collaboratively written. `asset_list` and `asset_read` responses can now include a `cowritten: true` flag, surfacing when an artifact's slug is detected as collaboratively written, or when the underlying list call itself reports the artifact as cowritten. - Area: Artifacts - Names: `cowritten` - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### orgPluginSettings served in a new array form, but old desktops ignore it A new plugin settings format only works on newer Desktop builds; older ones ignore it. The gateway-serving validator now warns whenever a served config contains `orgPluginSettings`, since the array form is only understood by Claude Desktop 1.15200.0 and later. Clients on older Desktop builds silently ignore the setting and instead enforce no plugin tool policy at all, so the effect of this server-side change depends on the connecting client's version. - Area: Plugins - Names: `orgPluginSettings` - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### thinking_tokens frames now carry the triggering user message uuid Live thinking-token frames now carry the triggering user message's uuid for attribution. Live `thinking_tokens` progress frames in stream-json and the Agent SDK are now stamped with `user_message_uuid`, the client uuid of the triggering user message (from `submitMessage` `options.uuid`). This lets a consumer attribute thinking progress to a specific send before any reply frame arrives. The field is absent on synthetic or scheduled turns, turns without a client uuid, and on Remote Control (interactive terminal) sessions. - Area: SDK - Names: `user_message_uuid` - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Org compliance policy can silently drop custom anthropic-beta headers HIPAA compliance mode now silently drops custom anthropic-beta headers and disables 1M-context. When HIPAA compliance mode is active, any `anthropic-beta` header set via `ANTHROPIC_CUSTOM_HEADERS` is now dropped, with a debug log noting that experimental betas are disabled by org policy. The same compliance gate now also forces the 1M-context beta detection to always return false, and the SDK's beta-header resolution logic gained a similar case that drops all experimental beta headers and logs when the org-compliance gate is active, distinct from the existing per-header filtering. - Area: Elsewhere - Names: `ANTHROPIC_CUSTOM_HEADERS` - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### "control-request" thin-client dispatch mode added to /memory and /skills /memory and /skills gain a control-request dispatch mode for thin remote clients. `/memory` and `/skills` now declare `thinClientDispatch: "control-request"`, a dispatch mode alongside the existing "post-text" and "twin" modes that lets a remote/thin client run these commands via a control-request instead of needing full workspace access. - Area: Sessions - Names: `/memory`, `/skills`, `thinClientDispatch` - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Whiteboard skill now has a 'live' mode variant The whiteboard skill now branches into a separate flow for live-mode artifacts. The whiteboard-pairing skill now branches on whether the artifact is in "live" mode, loading a different set of skill files and prompt, including a "data" capability, instead of always following the previous single flow. - Area: Artifacts - Tier: Nothing to try yet - Useful: 2/5 - Signal: 2/5 ### Artifact auto-reply can now be held pending human approval, with account-change detection Held auto-replies now stand down if the active account changed while waiting. The artifact comment auto-reply/auto-react pipeline gains a "held reply" flow: replies waiting on a person's answer are queued in a `heldReplyChain` and re-checked before posting. If the active account changed while a reply was held, the reply is stood down instead of posted, emitting a new `held_reply_account_changed` telemetry reason. - Area: Artifacts - Names: `held_reply_account_changed` - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### Usage/rate-limit schema expanded with new plan buckets Usage/rate-limit parsing now recognizes several new plan buckets and extra-usage details. The usage/rate-limit parser recognizes new plan buckets beyond `five_hour`/`seven_day`: `seven_day_oauth_apps`, `seven_day_opus`, `seven_day_sonnet`, and `cinder_cove`. It also parses a structured `extra_usage` object (`is_enabled`, `monthly_limit`, `used_credits`, `currency`, `disabled_reason`) and per-limit scope/model/surface display names. - Area: Usage & Limits - Names: `seven_day_oauth_apps`, `seven_day_opus`, `seven_day_sonnet` - Tier: You'll notice - Useful: 2/5 - Signal: 2/5 ### New ask-rule fallback logic in tool permission checks Permission checks gain a new fallback path that can surface an ask decision where none existed before. Tool permission checks gain a new fallback path for ask-rule decisions. One helper produces an implicit "ask" decision from `ruleTargetInput` when no explicit rule is supplied, and another composes deny/ask precedence with a caller-supplied override. `checkPermissions` now consults this fallback via `Ntn(R, D, n.ruleTargetInput)` after existing deny/ask rule lookups return nothing, so tools that previously had no matching ask rule can now still surface an ask decision through this path. - Area: Permissions - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Model catalog now does a stale-while-revalidate background refresh Model catalog now refreshes stale entries in the background instead of blocking on a re-fetch. Both the published-catalog and served-catalog model resolution paths now support stale-while-revalidate: when a cached catalog entry exists but is stale, Claude Code kicks off a background re-fetch and waits up to the network timeout for it, falling back to the stale entry if the refresh doesn't complete in time. This can return a stale cached catalog immediately while the refresh runs concurrently, and logs whether the stale value was kept or refreshed; the behavior is unconditional, with no flag gating it. - Area: Model Catalog - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### New shorter artifact URL format with base58-encoded IDs Artifacts now get shorter URLs using a 22-character encoded id. Artifacts get a new, shorter URL format, `/artifact/`, using a 22-character base58-encoded ID, alongside the existing `/code/artifact/` format. New helpers decode the base58 ID back to a UUID and build or parse URLs in either format. - Area: Artifacts - Tier: You'll notice - Useful: 3/5 - Signal: 1/5 ### Claude in Chrome MCP tool calls now re-check org policy at call time Chrome extension tool calls now re-check org policy at call time, not just at install. Claude in Chrome MCP tool calls now check the `allow_claude_browser_extension` managed org policy at the moment a tool call is made, not just at install or upsell time. If the policy denies the extension, the call now throws "Claude in Chrome call refused by org policy" instead of proceeding. The enforcement extends across the whole Chrome bridge: the `/chrome` settings command, the auto-enable path, and the startup dialog that offers to connect Claude in Chrome all now gate on this policy. The MCP server itself refuses to start when `CLAUDE_CODE_CHROME_MCP_ORG_DENIED` is set in its environment, exiting with cause `parent_org_policy`, and MCP connections that are blocked fail with errorCode `POLICY_BLOCKED`. The policy check defaults to denied until an org verdict is confirmed, and `allow_claude_browser_extension` has also been added to the HIPAA compliance-taint list, so HIPAA-restricted orgs block it by default. Where the policy can't be verified (third-party/custom base URL providers, missing claude.ai sign-in, or network errors), Claude Code now logs an explicit warning and relies on the extension itself to enforce the org setting. - Area: Chrome & Browser - Names: `allow_claude_browser_extension` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Bash task completion notifications now carry a 'stopCause' Background bash task notifications now record why the task stopped. Notifications for completed or killed background bash tasks now carry a `stopCause`, threaded through into both the task snapshot and the delivered summary, recording why a shell task stopped. - Area: Background Tasks - Names: `stopCause` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### New notification when a resumed agent's task delivery is redirected An agent resumed by another agent now learns its task result won't be delivered to it. When a task-owning agent is resumed by a different agent, the original agent now receives a notification that its completion "will not be delivered here" since the task has been reassigned to report to the new owner. - Area: Subagents - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Artifact reads try a stored-source path before falling back to the gateway relay Local artifact file reads are now faster via a direct path before falling back to gateway relay. Reading artifact files now first tries a direct `_src` path read, bypassing the session gateway, and only falls back to the previous gateway-relay behavior if that read isn't ok/200, logging the fallback. This is a performance path for locally-stored artifact sources. - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Declined artifact-comment auto-reply now records user feedback and stops future auto-drafts Declining an auto-drafted comment reply now stops further auto-drafts on that artifact for the session. When you decline a drafted reply to an artifact comment thread (in ask mode) and give a reason, that feedback is now surfaced back into context, and Claude Code stops auto-drafting replies to comments on that artifact for the rest of the session. You're pointed at a manual way to reply instead. - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Artifact comments tool: reply/resolve can auto-approve via rule engine Replying to or resolving artifact comments can now auto-approve instead of always asking. The comments tool's reply and resolve actions now check an auto-classifier rule set before falling back to asking the user, and can suggest an always-allow rule via `suggestions`. Previously these actions always asked and suppressed the always-allow option. - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Structured-output tool now lints schemas for unsatisfiability StructuredOutput schemas are now linted for internally-contradictory constraints. StructuredOutput tool schemas are now analyzed for internally-contradictory constraints, such as crossed min/max bounds, required properties missing from `properties` with `additionalProperties: false`, and enum/const type mismatches, in addition to the existing strict-schema conversion. Findings are surfaced via a new `unsatisfiable` field and reported through the `tengu_structured_output_schema_lint` telemetry event. - Area: Structured Output - Names: `tengu_structured_output_schema_lint` - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### toolSearchEnabled now also covers Chat sessions and has version-tiered request shaping Tool search setting now also applies to Chat sessions, with version-based request shaping. The `toolSearchEnabled` setting's description now states it applies to Cowork, Code, and Chat sessions, up from a narrower scope. Behavior also now differs by app version: apps bundling Claude Code 2.1.247 or later add only the tool-search beta shape, while older builds instead lift full experimental-beta suppression. - Area: Elsewhere - Names: `toolSearchEnabled` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Artifact reads now check per-URL deny rules Artifact reads now respect your deny rules matched on the artifact URL. Artifact read and asset requests, specifically `list_assets` and `read_asset` (but not `delete_asset`), are now checked against the user's permission deny rules matched on the artifact URL before proceeding. A request blocked this way is refused with a message naming the specific tool and deny rule, for example "Reading this artifact is blocked by your ${toolName} deny rule." - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Transcript now shows a spacer marker where context was cleared The transcript now shows a visual spacer where context was cleared or compacted. The transcript now inserts a spacer marker at the point where context was cleared, such as via `/clear` or compaction, giving a visual break between cleared and post-clear messages instead of showing them contiguously. The spacer works like the existing 'unseen messages' divider, taking up a blank height equal to the viewport rows. - Area: Transcript - Names: `/clear` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Settings screen warns when editing a remote/cloud session's config Settings now warns you when editing config for a remote session that won't apply live. The settings dialog now shows a note when editing a remote/cloud session's config, explaining that changes made from this machine apply only to future cloud sessions and to this machine's local settings, not to the currently running remote session. The dialog's height calculation was adjusted to make room for this note. - Area: Settings - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Remote agent isolation falls back to worktree when unavailable Remote agent isolation now falls back to worktree or local when remote execution isn't available. When `isolation:'remote'` is requested for a spawned agent but remote execution isn't available, for example due to no claude.ai login, the feature gate being off, restricted mode, or no git root, Claude Code now logs the reason and falls back to `worktree` isolation, or runs the agent locally, instead of failing. - Area: Subagents - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Hosted/hybrid managed-config validation hardened against credential leakage and unbounded arrays Managed config validation now rejects entries that look like they leak credentials. Managed-config validation for the hosted control plane (hybrid channel) now rejects entries that look like they contain a credential header, that carry disallowed query strings or fragments on base URLs, or that exceed array-length bounds. Rejected entries are not stored, and the error points admins to a helper script instead. - Area: Admin Settings - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Artifacts tool results flag co-writer / type-published content as untrusted Artifact tool results now flag co-writer or type-published content as untrusted data. Tool results for `asset_list`, `asset_read`, and `file_read` now include a `cowritten` signal (and `from_type` for file listings) so the model can tell when a co-writer or an Artifact type's publisher produced the content rather than the user. The returned text explicitly warns to treat such assets or files as untrusted data rather than instructions. - Area: Artifacts - Names: `cowritten`, `from_type` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Artifact publish now reports server-side file copies Artifact publish now lists each file the server copied in, with its source. When publishing or updating an Artifact, if the server copies files in on your behalf, the tool result now lists each destination path along with its source URL and source path. The message clarifies that these copied files are now independent and addressable by their new path. - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Artifact publish can notify a comment thread it was seeded from Publish results can note when an artifact was seeded from a comment thread, prompting a reply. Artifact publish results can now include a `seededThread` field indicating the artifact was seeded from a comment thread, prompting the model to reply on that thread since republishing does not itself notify the commenter. - Flag `tengu_madrone_spindle_corbel`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: no gate table built for this version) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Names: `seededThread` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Plugin marketplace errors now distinguish unreadable catalogs and hidden registrations Plugin errors now distinguish unreadable marketplace catalogs from hidden registrations. Plugin loading now tracks `unreadableCatalogs`, marketplace catalogs that failed to read, and surfaces richer error info per plugin: whether its marketplace registration was hidden by policy (`registrationHidden`), whether its source is unverifiable, and whether a catalog read specifically failed (`catalogReadFailed`) as opposed to merely being missing from cache. - Area: Plugins - Names: `registrationHidden`, `catalogReadFailed` - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### New guard against copying files from an unconsented Artifact source Copying files from another artifact is now blocked outright when no one is present to consent. Publishing that copies another Artifact's files into the current publish is now denied outright when there is no live human present to consent, with a new `safetyCheck` reason explaining that copying needs a consent surface and no one can answer the prompt in this session. - Area: Artifacts - Names: `safetyCheck` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### New URL validation rejects credentials/backslashes in managed-config URLs Managed config URLs with embedded credentials or backslashes are now rejected. A new `urlWithSchemeCoercion` refinement rejects URLs whose authority contains userinfo (`user:pass@`) or a backslash, replacing the old bare `.url()` check. Managed config settings that take a URL now fail validation with the message `URL must not contain credentials or a backslash in the authority` instead of silently accepting a credentialed or spoofable URL. - Area: Admin Settings - Names: `urlWithSchemeCoercion` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Model switch now probes availability before showing the picker /model now shows a checking-availability step before displaying model choices. The `/model` picker now shows a `Checking model availability…` interstitial before displaying model choices, running an availability check first instead of rendering the menu immediately. - Area: Models - Names: `/model` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Plugin hook loading now detects and reports when a managed plugin's hooks silently disappear Claude Code now detects and warns when a managed plugin silently loses its hooks. Plugin hook loading now tracks which plugin sources actually delivered hooks across registration passes, and distinguishes a managed plugin that "loaded without its hooks" from one that "did not load" at all. If a previously-hook-bearing managed plugin loses its hooks or fails, this is now logged as a warning and reported via a new `managed_plugin_unloaded` telemetry event. - Area: Plugins - Names: `managed_plugin_unloaded` - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Artifact auto-reply gains an 'ask mode' path instead of only allow/deny Artifact auto-reply now has an ask-mode path instead of only allowing or denying. The artifact-comments autoreact pipeline now has a third outcome besides allow and deny. When a permission decision is neither a clean allow nor a hard denial, the thread is marked with status `needs_user` and reason `approval_required` instead of being silently declined, and a held-reply notice with its own summary is surfaced to the user. - Area: Artifacts - Names: `needs_user` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### GitLab remote URL / subgroup support in repo detection Repo detection now recognizes GitLab remotes, including nested subgroup paths. Repository host detection now specifically recognizes GitLab remotes, including nested subgroup paths, via a new URL parser that validates the host is GitLab and splits owner path segments. This feeds into the git repo/host caching used by the review and ultrareview flow. - Area: Git Integration - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### /advisor command reports a 'consent_pending' telemetry state and per-session-only setting /advisor now tracks a pending-consent state and can be set for just the current session. The `/advisor` command's telemetry now distinguishes four states: `off`, a valid advisor choice, `consent_pending` for models that require consent, and `invalid`, instead of just reporting the raw name and a remote flag. `/advisor` can also now set the advisor for the current session only in certain contexts, with messaging telling the user to run `/advisor` in the terminal to change their persistent default. - Area: Elsewhere - Names: `/advisor` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Background remote session bridge can now record created PRs Background remote sessions can now record PRs they created back to the backend. The remote bridge session object gained a `recordCreatedPR` method that posts `owner`, `repo`, `pr_number`, and `head_ref` to a new session endpoint, allowing the backend to track PRs created during a bridged or background session. - Area: Sessions - Names: `recordCreatedPR` - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### New kept-worktree state: unpushed_shared Worktrees shared with another finished job's unpushed commits are now kept instead of offered for discard. A new kept-worktree reason, `unpushed_shared`, applies when a worktree has commits that aren't pushed anywhere and another finished job's `state.json` also references it. In this case the worktree is kept and no discard is offered, to avoid destroying another session's output. - Area: Sessions - Names: `unpushed_shared` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### MCP server manifest resolution: local servers can now satisfy first-party host references Local MCP servers can now satisfy manifest references to first-party hosts by name match. When resolving a capability manifest's MCP server entries against a first-party host id, the resolver now also checks whether a locally-configured server's name (or its normalized form) matches that host. If it does, the manifest entry is treated as referring to that local server (`local_server_as_first_party`) instead of being flagged as unresolved or opaque. - Area: MCP - Names: `local_server_as_first_party` - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Config deprecation framework for inference gateway/Vertex auth settings Old inference gateway/Vertex auth settings now get structured deprecation guidance. A new deprecation-tracking system, `BATCH_2026_09`, flags several legacy inference/auth config values with structured migration guidance and an explicit `effect` string describing what breaks if left unmigrated. `inferenceGatewayAuthScheme: "sso"` is deprecated because it's no longer inferred as browser sign-in; use `inferenceCredentialKind: "interactive"` instead. `inferenceGatewayAuthScheme: "auto"` is now just rewritten to `"bearer"`. For Vertex AI, `inferenceCredentialKind: "oauth"` is rewritten to `"interactive"`, and combining `inferenceCredentialKind: "interactive"` with `inferenceVertexWorkforceAudience` is flagged as ambiguous, with guidance to use `"workforce"` instead. - Area: Auth - Names: `inferenceGatewayAuthScheme`, `inferenceCredentialKind` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### --json-schema now warns on unusable schemas instead of failing silently An unusable --json-schema now warns you with the specific problem instead of failing silently. In `--print`/non-interactive mode, passing a `--json-schema` that can't actually be satisfied (for example, one missing the required object/properties structure) now produces a warning naming the specific problem before the CLI proceeds, instead of failing silently. - Area: CLI - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### New 'standing permission unavailable' explanation added to the approval card The approval card now explains when 'Always allow' isn't available for a host. The permission-approval UI has a new localized message explaining that "Always allow" isn't yet available for a given host. It renders on both the command-approval and file-approval cards so users understand why the standing-permission option is missing. - Area: Permissions - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Headless-session turn events now settle with a timeout before ending a turn Headless SDK turns now wait briefly for side-effect events to settle before ending. Headless SDK sessions now wait for pending turn-side-effect events to settle, via a new severable event collector, before completing a turn. A configurable settle timeout bounds this wait; if the events don't settle in time, the turn ends anyway and a warning notes that their late notes were dropped. - Area: SDK - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Artifact 'handlers' terminology renamed to 'endpoints' Artifact 'handlers' terminology is renamed to 'endpoints' throughout. Artifact server-side handler actions are renamed from `get_handlers`/`call_handler` to `get_endpoints`/`call_endpoint`. The default description text also changes from "server-side handlers" to "server-side endpoints" to match. - Area: Artifacts - Names: `get_endpoints`, `call_endpoint` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Artifact tool now enforces deny permission rules on all non-read actions The artifact tool now checks deny rules before running any non-read action. The artifact tool's `checkPermissions` now checks deny rules before running any action other than `read`, blocking the call with a message naming the matching deny rule if one applies. - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### FileHistory rewind now tracks failed restores separately from skipped links File rewind now separately tracks files that failed to restore versus symlinks it skipped. FileHistory's rewind-restore now returns a `filesFailed` array instead of just a skip count, letting callers tell files that failed to restore or delete apart from files skipped because they're symlinks. Failures caught in the restore's catch block are now recorded in this list too. - Area: File History - Names: `filesFailed` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Follow-up questions supported in the Q&A summary UI The Q&A summary UI now shows when Claude was asked follow-up questions. The Q&A summary UI that shows answered `AskUserQuestion` turns can now also render a follow-up state, displaying "User asked Claude for more questions" (with or without answers so far) instead of only the "User answered Claude's questions" message. - Area: AskUserQuestion - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Vertex/Bedrock/Foundry inference settings hardened Several Vertex/Bedrock/Foundry settings are now more locked down with consent and redaction changes. Several Vertex, Bedrock, and Foundry inference settings are now more locked down: Vertex's `region`/`baseUrl` and Bedrock's `ssoRegion` gained `readers: ["desktop", "m365"]` restrictions and/or `requiresUserConsent` on remote policy. The Vertex OAuth `clientSecret` field's redaction changed from `redact: "drop"` to `redact: "presence"`, with a new hint that Google treats installed-app client secrets as non-confidential, so it may be set from hosted config. - Area: Auth - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Claude.ai data-import toggle no longer force-hidden in enterprise config UI The Claude.ai data-import toggle is no longer hidden in enterprise settings UI. The organization/enterprise config field for "Claude.ai data import" is no longer force-hidden in the settings UI; it previously carried a `predicates: { show: () => !1 }` rule that hid it unconditionally, and that predicate has been removed. Its description now spells out the behavior in detail: it lets users import Claude.ai chats and projects, plus earlier Claude sessions on this computer, when `enabled` is true, and notes that `automatic3pImport` is a separate switch. Its egress requirements now also branch on an "arm" state (configured vs. default hosts). - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Workflow tool: stricter schema validation for structured agent() output agent() structured output schemas now must be valid objects, or they fail immediately. Schemas passed to `agent()` for structured output in the workflow scripting API must now have `{type: 'object', properties: {...}}` at the root, and `required` must be a subset of `properties`. Unsatisfiable schemas now throw immediately at the `agent()` call instead of failing later. - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### MCP registry lookup dropped from 'nonessential services' block list The MCP registry lookup is no longer blocked by the nonessential-services privacy setting. The "block nonessential services" privacy setting no longer blocks the connector directory (Anthropic MCP registry) lookup. It now covers three outbound fetches instead of four: connector favicons, the artifact-preview iframe, and the MCP Apps widget iframe. - Area: Elsewhere - Names: `disableNonessentialServices` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### kill-session-after-min clarified: idle/prompt-parked sessions are released, not killed, at the cap --kill-session-after-min now clarifies idle sessions are released and resumable, not killed. The help text for `--kill-session-after-min` now clarifies what actually happens at the wall-clock deadline: a session that is idle, parked at a permission prompt, or still starting up is released (paused server-side and resumable) rather than killed. Only a session with a turn still running, or one where the server keeps declining the release, gets SIGTERMed at the hard cap. - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Thinking-block stripping can now preserve thinking up to a given occurrence Thinking-block stripping can now preserve earlier thinking blocks up to a given occurrence. The function that strips `thinking` and `redacted_thinking` blocks from assistant messages now accepts an index `n`, so only thinking blocks after the nth occurrence are removed. Earlier thinking blocks, and any empty text following them, are now kept instead of always stripping everything. - Area: Thinking Mode - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### macOS Keychain files added to sandbox-protected paths macOS Keychain files are now always protected by the sandbox. On macOS, the sandbox's list of always-protected paths now also includes `~/Library/Keychains`, alongside the existing SSH, GPG, and AWS backup directories. - Area: Sandbox - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### SDK init frame now reports skills and plugins in use SDK init handshake now reports which skills and plugins are in use. The stream-json / Agent SDK init handshake now also parses `skills` and `plugins` arrays from the init frame, alongside the existing `tools` array, logging an error if either is malformed. This surfaces enabled skills and plugins to SDK consumers. - Area: SDK - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Egress allowlist widened to claude.ai and claude.com domains Egress allowlist now accepts claude.ai and claude.com domains, not just anthropic.com. The egress allowlist now accepts hosts under the `claude.ai` and `claude.com` domains in addition to `anthropic.com`, via a new domain-matching helper. New named host constants were also added for `claude.ai` and Google Cloud Storage signed URLs. - Area: Sandbox - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Checkpoint rewind gains a documented `skippedLinks` telemetry/response field for symlink-safety refusals Checkpoint rewind now documents a field counting files skipped for symlink safety. Checkpoint rewind responses now document a `skippedLinks` field, counting tracked files that weren't restored because a symlink or hard link was found at the tracked path, a parent directory no longer resolves correctly, or the backup couldn't be safely read. This field is only populated on a real (non-`dryRun`) rewind; `dryRun` previews never set it and their counts don't reflect link-safety refusals. - Area: Sessions - Names: `skippedLinks` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Marketplace-not-found error now distinguishes registry-read failures and hidden registrations Marketplace-not-found errors now distinguish unreadable registries from hidden registrations. The marketplace-not-found error now distinguishes three cases instead of always saying "not found": if the marketplace registry couldn't be read, it points to `known_marketplaces.json` and suggests running `/reload-plugins`; if the marketplace is registered but hidden (refused, visible in the debug log), it suggests removing and re-adding the marketplace; otherwise it falls back to the old "available marketplaces" message. - Area: Plugins - Names: `/reload-plugins` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Auto-compact setting now can fully satisfy context-window sizing for large models Auto-compact can now use a large model's full default context window without extra enforcement. When a model's context window meets a new size threshold and doesn't replace the default, and auto-compact is enabled, Claude Code now uses the model-default window at full size instead of subjecting it to unknown-model window enforcement. - Area: Compaction - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### New 'unpushed_shared' git repo warning state A new warning state flags repos with unpushed commits shared with another finished session. A new `unpushed_shared` repo-state reason is now reported for repos that have unpushed commits and are also recorded by another finished session, alongside the existing `unpushed` reason, for use in session-selection/reuse warnings. - Area: Git Integration - Names: `unpushed_shared` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### '/setup-cowork' command renamed to '/setup-claude' /setup-cowork is renamed to /setup-claude, with the old name still working. The `/setup-cowork` guided setup command has been renamed to `/setup-claude`, with `setup-cowork` kept as an alias for backward compatibility. The onboarding heading also changed from "Setup Cowork" to "Guided setup". - Area: Elsewhere - Names: `/setup-claude`, `/setup-cowork` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Artifact co-writer / type-derived content consent gating Artifacts now distinguish co-written content from type-derived content for consent purposes. Consent handling for artifacts now distinguishes content co-written by a non-owner from content whose files or assets derive from an artifact type the user didn't author. Reading such content throws a distinct refusal unless consent was granted, with messages like "a co-writer has published to this artifact" and "[ownership: yours, co-written: a non-owner has also published to it]". - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### New unpushed-commit summary in worktree-kept messages claude rm now prints a readable summary of unpushed commits kept in a worktree. When `claude rm` keeps a worktree because it has unpushed commits, it now prints a human-readable summary such as "N unpushed commit(s) on ``" including each commit's short SHA and subject, generated from a new git log helper. - Area: Sessions - Names: `claude rm` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Incremental cloud-session deltas added to session event stream Cloud session updates now stream as incremental deltas instead of full re-emission. The cloud session event stream can now emit a `cloud_session_delta` system event carrying just the changed keys of a session block, instead of relying only on full re-emission when the session changes. The emitter tracks the last emitted session block and debounces before sending the delta. - Area: Cloud Sessions - Names: `cloud_session_delta` - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Autocompact eligibility extended to side_question and extract_memories query sources Autocompact now also applies to side-question and memory-extraction query types under large windows. Autocompact eligibility now extends to the `side_question` and `extract_memories` query sources, which were previously excluded. This only applies when the effective context-window setting didn't come from env or settings, the window is at least 1,000,000 tokens, and an additional condition holds. - Area: Compaction - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Artifact publish: files copied server-side from other artifacts are now itemized in the ask-permission message Publish permission prompts now itemize server-copied files by name and ownership. When publishing an artifact that includes files copied server-side from other existing artifacts, the permission prompt now itemizes those files by name and ownership status: "someone else's", "ownership unconfirmed", or "yours; a co-writer has also published to it". - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### New diagnostics for unexpected prompt-cache breaks A new diagnostic explains why the prompt-cache hit rate suddenly dropped. A new diagnostic analyzes why a prompt-cache hit rate suddenly dropped, checking causes like a changed system prompt, changed tools, TTL expiry, or a changed model. It logs a categorized 'causes' list at warn level with a `[PROMPT CACHE BREAK] ...` line, including source, call count, and cache read/creation details. - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### WebFetch of claude.ai artifacts: new consent flow for reading others' artifacts while network access is off Reading someone else's artifact now clearly states whether network access is on or off first. When Claude fetches an artifact you don't own or whose ownership is unverified, the consent prompt now states plainly whether this session's network access is on or off, since that determines whether the artifact's content can enter the conversation. This replaces the older, more generic message, and the underlying check (now framed as a 'consent surface' rather than 'read is user only') runs an egress probe before granting read access. - Area: WebFetch - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Bedrock upstream gains native CountTokens support Bedrock now uses its native token-counting API instead of a workaround request. The Bedrock SDK client wrapper now exposes a `countTokens` method that calls Bedrock's native CountTokens API through a lazily-created client, with a fallback warning path that uses a `max_tokens: 1` request for the aborted-request token count if the call fails. - Area: Bedrock - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Permission tool-rules now redactable in config exports Permission tool rules can now be redacted properly when exporting config. The settings redaction system has a new `"toolRules"` redact policy for permission rule keys/values. It maps values through `parseBuiltinRule`, hashing rule values except for the literal `"allow"`/`"ask"`, while preserving recognizable tool names, and is used when exporting or redacting managed config that includes permission tool rules. - Area: Admin Settings - Names: `toolRules` - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Custom inference headers now blocked from carrying credentials, with legacy key deprecated Custom inference headers now explicitly warn against putting credentials in them. The `inferenceCustomHeaders` field's guidance now explicitly warns not to put API keys, bearer tokens, or other credentials in it, a change from the previous guidance allowing generic per-request headers including auth. The legacy flat key `inferenceGatewayHeaders` is now marked deprecated, with an explicit message describing its fallback effect. - Area: Auth - Names: `inferenceCustomHeaders`, `inferenceGatewayHeaders` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Egress allowlist entries now carry human-readable purposes Egress allowlist entries now explain in plain language why each host is contacted. Every entry in `EGRESS_SERVICES`, the desktop app's network egress declaration used for firewall/allowlist UI, now includes a human-readable `purpose` message explaining why that host is contacted, plus a `firewallAlsoPurpose` field for secondary hosts. These are surfaced to admins and users deciding what network access to allow. - Area: Sandbox - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### New approval/call statuses for stalled uploads New status messages explain when a stalled connection left an upload or approval unconfirmed. Two new call outcome states, `write_unresolved` and `approval_write_unresolved`, now surface when a stalled connection prevents a tool call from being confirmed as sent. The user-facing message explains that the session's connection to the service was backed up, with the upload either not completing or ending without an answer. A parallel message covers the matching case for approvals: the tool itself may not have received the approval because the session's upload of that approval could not be confirmed in time. - Area: Cloud Sessions - Names: `write_unresolved`, `approval_write_unresolved` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### /diff fullscreen toggle live by default via a kill-switch flag The /diff fullscreen toggle is now on by default for everyone, with a kill-switch to disable it. The `/diff` command's fullscreen behavior — "Toggle the diff panel showing uncommitted changes" with immediate fullscreen mode — is now active by default for everyone. It is controlled by a kill-switch flag, `tengu_jazzy_ripple`, that must be explicitly turned on to suppress the new behavior. - Flag `tengu_jazzy_ripple`: Not enough to say (read for one account on one subscription tier against v2.1.260; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Diff View - Names: `/diff`, `tengu_jazzy_ripple` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Autocompaction now skips huge-context side-question/extract-memories subagent calls Autocompaction now skips huge-context side-question and memory-extraction subagent calls entirely. A new guard skips autocompaction entirely for query sources of type `side_question` or `extract_memories` when the effective context window is at least 1,000,000 tokens and that window wasn't set via env or settings config. This is a live behavioral change, not gated behind an experiment flag, and is reachable whenever `CLAUDE_CODE_REMOTE` isn't restricting the session. - Area: Compaction - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Ajv validation error messages now include actual values Validation error messages now show the actual value that violated a schema constraint. StructuredOutput validation error messages for `minLength`/`maxLength`, `minItems`/`maxItems`, `minProperties`/`maxProperties`, `enum`, and `const` violations now include the actual observed value or count, for example "(got 5)", instead of a bare Ajv message. - Area: Structured Output - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Publish result can report refused sidecar copies Publish results now list any copied sidecar files that were refused for their content type. The publish result object can now include a `refusedClassSidecarTypes` field listing copied files whose content type was refused as a renderable or executable sidecar. - Area: Artifacts - Names: `refusedClassSidecarTypes` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Settings search UI shows a description line under the search box Settings search now shows a short description line under the search box. The settings-search screen now shows an extra dim line of descriptive text directly beneath the 'Search settings…' input, when such text is available for the selected item. - Area: Settings - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Remote session now propagates skills/plugins list from worker init Remote session init now also captures the skills and plugins list, not just commands and model. When a remote/cloud session's init frame arrives, the client now also captures its `skills` and `plugins` fields, in addition to the `slash_commands` and `model` fields it already captured. - Area: Sessions - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### MCP web-search built-in server pushes API keys out of `headers` Web-search MCP server config now steers you away from putting API keys directly in headers. The built-in websearch MCP server's config schema now steers users away from putting provider API keys directly in `headers`. New copy explains that the API key is a credential and should instead be printed by a headers helper script rather than stored inline in the config. - Area: MCP - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### file_read results now flag Artifact-type-authored files as untrusted Files from an Artifact type's publisher are now flagged as untrusted when read. When `file_read` returns a file that originates from an Artifact type rather than the user or a co-writer, the result now warns that the file was written by the type's publisher and should be treated as untrusted data, with an explicit instruction not to act on embedded instruction-like text. - Area: Artifacts - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Workflow agent StructuredOutput retry-cap error now includes the last failure reason Retry-cap errors now include the last actual failure reason instead of just a count. When a workflow agent exceeds its StructuredOutput retry cap, the thrown error now appends the text of the last StructuredOutput tool error instead of just reporting the retry count, giving more actionable context for diagnosing the failure. - Area: Structured Output - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### OTLP endpoint description broadened beyond Cowork OTLP endpoint setting description now covers general telemetry, not just Cowork. The OTLP endpoint setting's description was broadened from Cowork-specific telemetry to general telemetry, and the field now lists readers `desktop` and `m365`, indicating it now also applies to Code/desktop sessions rather than only Cowork. - Area: Telemetry - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### OTLP headers/resource attributes gain legacy-encoding deprecation warnings OTLP headers/attributes now warn if you use the legacy string encoding. `otlpHeaders` and `otlpResourceAttributes` now go through a `kvRecord` wrapper carrying a `legacyKvEncodingNotice` deprecation warning, which flags that using the legacy string encoding will result in no headers or attributes being sent. - Area: Telemetry - Names: `otlpHeaders`, `otlpResourceAttributes` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### "list files/assets" MCP approval scope narrowed Listing artifact assets now asks for consent per-listing instead of for the whole conversation. The consent text for listing an artifact's published files/assets was changed from granting a standing approval covering the rest of the conversation to covering only that single listing. - Area: Artifacts - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Vertex Workforce Identity billing project now requires user consent Vertex Workforce billing project setting now requires user consent before being pushed remotely. The `inferenceVertexWorkforceUserProject` config field (the GCP billing project for Vertex Workforce Identity) now sets `remotePolicy: { requiresUserConsent: true }`, so it can no longer be pushed without the user's consent, matching the stricter handling already applied to other connection fields. - Area: Auth - Names: `inferenceVertexWorkforceUserProject` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Bedrock base URL now requires user consent Bedrock base URL now requires user consent before being remotely applied. Remote-set values for `inferenceBedrockBaseUrl` now require explicit user consent before being applied, via a new `requiresUserConsent` flag added alongside the existing `rejectLoopback` and `originPinned` settings in its remote policy. - Area: Auth - Names: `inferenceBedrockBaseUrl` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Sandbox mask sweep now gated by macOS 'relaxed' sandbox mode too Credential-file mask sweep now also runs on macOS in relaxed sandbox mode. The credential-file mask-sweep eligibility check, previously limited to Linux and WSL, now also runs on macOS when the sandbox mode is set to `relaxed`, so masked credential files get swept for glob-pattern matches in that case too. - Area: Sandbox - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Artifact comments: reply required to clear "awaiting reply" flag Guidance clarifies that only an actual reply clears an artifact comment's awaiting-reply flag. Artifact tool guidance now clarifies that a comment marked `awaiting_reply` is only resolved by an actual reply on its thread; editing or republishing the artifact, or answering within the session, does not notify the commenter. - Area: Artifacts - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### AutoUpdateConfig description rebranded from Cowork to Claude Desktop, and reorganized into a new settings group The block-auto-updates setting description now refers to Claude Desktop instead of Cowork. The "Block auto-updates" (`AutoUpdateConfig`) setting's description now refers to "Claude Desktop" instead of "Cowork," reading that it stops fetching updates entirely with no time limit, and you'll need to push new versions yourself. The setting also moved out of the inline `af` group into the new exported `UPDATES_GROUP`. - Area: Elsewhere - Names: `AutoUpdateConfig` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Sandbox settings UI renamed Sandbox settings page section titles were shortened: Limits, Plugins, Egress. Several sandbox settings page section titles are shorter: "Usage limits" is now "Limits," "Plugins & skills" is now "Plugins," and "Egress Requirements" is now "Egress." - Area: Sandbox - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Sandbox read-deny settings now called out alongside Read rules in withheld-file explanations File-withheld explanations now also mention sandbox read-deny settings as a cause. Messages explaining why files were withheld from git or context now mention a sandbox read-deny setting as a possible cause, in addition to a Read permission rule. This appears both in the credential-scrub explanation and the git-upload refusal message, and similarly in messages about files left out of a cloud/session upload. - Area: Sandbox - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Result event now includes user_message_uuid The result SDK event now also includes the triggering user message uuid. The synthesized `result` SDK event now also includes `user_message_uuid` when it's available and the outcome isn't a terminal-reason exit, matching the same attribution added to `thinking_tokens` frames. - Area: SDK - Names: `user_message_uuid` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Unreadable-settings error now covers sandbox settings too, and points to /status Unreadable-settings warnings now cover sandbox settings and point to /status. The warning shown when a settings file has errors during a teleport/cloud-session bundle now also covers sandbox settings, not just Read rules, and lists which specific settings files could not be read. - Area: Settings - Names: `/status` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Sandbox/Read-rule denial messages now mention sandbox settings Read-rule denial messages now also mention sandbox settings as a possible cause. The explanation shown when a sync is blocked by a Read rule now also covers the case where a sandbox read-deny setting is the cause, and likewise for cases where the rules can't be read. - Area: Sandbox - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Essential/nonessential telemetry policy settings now apply unverified and fail closed Telemetry-disable settings now apply before verification completes and fail closed. The `disableEssentialTelemetry` and `disableNonessentialTelemetry` managed settings now carry `remotePolicy.applyUnverified: true` and `failClosedValue: true`, so they are honored even before signature verification completes and default to the blocking (`true`) value if verification fails. - Area: Telemetry - Names: `disableEssentialTelemetry`, `disableNonessentialTelemetry` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Claude.ai sign-in disable setting can now apply unverified, fails closed, excluded from hybrid scope The disable-sign-in setting now applies before verification and fails closed. The `disableDeploymentModeChooser` setting ("Disable Claude.ai sign-in") now has `remotePolicy.hybrid.scope: 'excluded'`, `applyUnverified: true`, and `failClosedValue: true`, so it applies before verification completes, defaults to blocking if verification fails, and is excluded from hybrid scope. - Area: Admin Settings - Names: `disableDeploymentModeChooser` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Cowork renamed to Claude Desktop in claude:// link setting description The claude:// link-blocking setting description now says Claude Desktop instead of Cowork. The description for the setting that blocks `claude://` deep links now refers to "Claude Desktop" instead of "Cowork". - Area: Elsewhere - Names: `claude://` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### "ProactivityMenu" keybinding context label reworded The proactivity keybinding help text now calls it a dialog instead of a menu. The help text for the `ProactivityMenu` keybinding context now describes "the proactivity dialog" instead of a menu. - Area: Terminal UI - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Managed settings now fail closed for nonessential-services and deep-link blocking Two more managed settings now fail closed if their value can't be verified. The `disableNonessentialServices` and `disableDeepLinkRegistration` managed settings now have `failClosedValue: true`, so if the managed-settings value can't be read or verified, the CLI defaults to the safe, blocking behavior instead of leaving the feature open. - Area: Admin Settings - Names: `disableNonessentialServices`, `disableDeepLinkRegistration` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Sandbox read-deny setting now surfaced in file-denial reasons File read denial reasons now also note sandbox read-deny settings as a cause. When a file read is denied, the explanation shown now also notes that a sandbox read-deny setting could be the cause, not just a `Read` permission rule. - Area: Sandbox - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### New `marketplace-not-found` error surfacing rule A marketplace-not-found error is now suppressed from the UI in certain hidden-registration cases. A new `marketplace-not-found` error type is now suppressed from UI display whenever `registrationHidden` is unset or set to `"network-location"`. - Area: Plugins - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Local endpoint tool actions renamed from 'handler' to 'endpoint' Local dev-server tool actions renamed from handler to endpoint. The local dev-server tool's action names have been renamed: `get_handlers` is now `get_endpoints` and `call_handler` is now `call_endpoint`. The `run_script` action is unchanged. - Area: Artifacts - Names: `get_endpoints`, `call_endpoint` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### New cloud-terminal restriction message for /statusline /statusline in a cloud session now tells you to run it locally instead. Running `/statusline` in a cloud/remote session now shows a message directing you to run it in a local `claude` session instead, since the status line it sets up shows in cloud terminals too. - Area: Cloud Sessions - Names: `/statusline` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Enterprise/Team account check gates a feature A feature gate now checks for enterprise/team plans, enabling optimistically while loading. A feature gate now checks the user's subscription type and enables it only for `enterprise` or `team` plans. While account data is still loading and the subscription type is unresolved, the check falls back to enabling the feature optimistically. - Area: Elsewhere - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New plugin reload/remote-session restriction messages New messages explain plugin reload and MCP server change limits over remote sessions. Two new messages tell users about remote-session limits: `/reload-plugins isn't available over a remote connection in this session`, and a note that plugin MCP server changes take effect in your next session. - Area: Plugins - Names: `/reload-plugins` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Chrome install upsell also checks org policy mid-wait and up-front Chrome extension install setup now checks org policy at more points, including mid-wait. The Chrome extension install-upsell flow now checks org policy at more points: it can now stop with `chrome_policy_denied` when the dialog first opens, or `chrome_policy_denied_mid_wait` if the policy check fails while waiting for the extension to connect during setup, reporting "Install setup stopped: organization policy (allow_claude_browser_extension) denied Claude in Chrome" accordingly. - Area: Chrome & Browser - Names: `chrome_policy_denied` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### New 'copy_from' action rendered in artifact tool-call UI The tool-call UI now shows a readable line for copy_from asset actions. The artifact tool-call renderer now handles a `copy_from` action, showing "copy N asset(s) from `` → ``", with verbose mode adding extra address and warning details. - Area: Artifacts - Names: `copy_from` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Structured-output retries now report model-fallback retractions Retry failures now specifically report when a model fallback retracted an attempt. Structured-output retry failures now report more specifically when some attempts were retracted by a model fallback, rather than treating them as ordinary validation failures, with a message like "Failed to provide surviving structured output after `${t}` attempts (`${r}` retracted by a model fallback)". - Area: Structured Output - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Artifact upload consent now also covers cross-artifact asset copies Session-long upload approval now also covers copying other artifacts' assets in. When a user approves an asset upload for the rest of the session, the approval message now also notes that the approval covers "copies of other artifacts' assets into" the artifact, reflecting that the new `copy_from` action is covered by the same consent. - Area: Artifacts - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Unattended-serving consent now also blocked by 'stale unresolved' state Unattended cloud commands now also treat stale unresolved consent as not consented. The check for whether a cloud-triggered unattended command is consented-to on this machine now also treats a "stale unresolved" consent record as unconsented, in addition to the existing checks for managed decline, missing acceptance, and revocation. - Area: Remote Control - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### PreModelSwitch/PostModelSwitch hook-load failures now give more actionable errors Failed model-switch hook loads now give a specific, actionable error message. When plugin-delivered `PreModelSwitch` hooks can't be loaded, the block reason is now a specific message explaining why, and notes that switching models again will re-check the hooks. `PostModelSwitch` hook-load failures similarly now include the underlying reason inline, instead of a generic message saying plugin hooks could not be loaded. - Area: Elsewhere - Names: `PreModelSwitch`, `PostModelSwitch` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Artifact live-content merge warnings now flag co-written / externally-edited content Merge instructions now flag co-written or externally-edited live content as data, not instructions. When a changed artifact is re-published and the merge instructions tell Claude to merge its edits onto the live content, those instructions now call out cases where the live content includes contributions from others, was edited in-page, or is data-island content. In those cases Claude is warned to treat that content as data to merge, not as instructions. - Area: Artifacts - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Fleet 'delete session' now offers a two-step discard for unpushed worktree changes Merge-on-republish warnings now also flag co-written or in-page-edited content as data to merge. When re-publishing a changed artifact, the 'merge your edits onto it' instructions now warn Claude specifically when the live content includes contributions from others (co-written), was edited in-page, or is data-island content, directing it to treat that content as data to merge rather than as instructions. - Area: Artifacts - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### AWS region regex loosened Managed MCP servers are now capped at 100 entries per org. The `ManagedMcpServers` schema now enforces a maximum of 100 entries, capping how many managed MCP servers an org can configure where previously there was no explicit limit. - Area: MCP - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Browser-extension access now also gated in a general permission-scope check Browser-extension access is now also checked by the general MCP/tool permission-scope gate. Browser-extension connections are now denied by the generic MCP/tool scope-permission check (`Ah`) when they don't come from the SDK, independent of the existing scope allowlist. This closes off a path that previously wasn't checked against the `allow_claude_browser_extension` gate. - Area: Chrome & Browser - Names: `allow_claude_browser_extension` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Background-task status narration prompt now sees the previous line Background task status lines now stay stable, only changing when something actually happened. The prompt that generates the one-line status text shown while a background or agent task runs now receives the previously-shown line and is told to repeat it verbatim if it's still accurate, only changing it when something actually happened or the goal moved. Its system prompt also adds explicit style rules: a 14-word maximum, no file paths or commands unless the user typed them, and describing the goal rather than mechanical steps. - Area: Background Tasks - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Structured-output-retry SDK error now surfaces the actual validation error SDK structured-output retry errors now show the actual validation failure instead of a generic message. When an SDK-driven structured-output query exhausts its retries, the error message now includes the specific validation error from the last attempt, falling back to the previous generic "Failed to provide valid structured output after maximum retries" message only when no specific error is available. - Area: Structured Output - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### New directory-sync failure reason: checkout refused as-is Directory sync now has a distinct explanation when a checkout is refused as-is. Cloud directory sync can now classify a checkout failure as `refused_here`, a distinct reason from generic git errors, with its own user-facing and Claude-facing explanation that the checkout was refused as it stands. - Area: Cloud Sessions - Names: `refused_here` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### notSent() now distinguishes a 'rule' rejection from a git-read failure Directory sync now explains separately whether changes weren't sent due to a rule or a git read failure. The directory-sync `notSent` reporter now takes a second parameter distinguishing a `"rule"` rejection from a git-read failure. For rule violations it explains that Claude's changes from this turn were not sent because of `o`, and that they go out with the first turn after that is fixed; a git-read failure produces separate explanatory text. - Area: Cloud Sessions - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Resume/rewind dialog gains a confirmDescription override The resume/rewind picker can now show a custom description instead of the default summary. The session resume/rewind picker now accepts a `confirmDescription` prop. Choosing "nevermind" shows a fixed note that the conversation will be unchanged, while other selections can show a caller-supplied description in place of the default restore-option summary. - Area: Sessions - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Watch-artifact session-start message dedup logic reworked The watch-artifact session-start message now dedupes across slug variants, not just one slug. The synthetic "user started this session watching the artifact ... (via `claude --watch-artifact`)" meta-message now uses new helper functions to decide whether it should be suppressed, checking slug variants seen in transcript history instead of the prior single-slug check. - Area: Artifacts - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### OTLP trace export no longer labeled beta OTLP trace export is no longer labeled as beta. The `otlpTracesEnabled` setting's title and description no longer mention beta status: "Export traces (beta)" is now "Export traces", and the description now refers to "Claude Code's session tracing" instead of "Claude Code's session-tracing beta". - Area: Telemetry - Names: `otlpTracesEnabled` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Cowork/Code surface toggles now fail closed and reject unverified remote policy Cowork/Code toggles now default to disabled instead of enabled if config can't be verified. The `coworkTabEnabled` and `isClaudeCodeForDesktopEnabled` settings now set `failClosedValue: false` and `remotePolicy: { applyUnverified: false }`. If the managed configuration can't be verified or parsed, these surfaces now default to disabled instead of defaulting on. - Area: Admin Settings - Names: `coworkTabEnabled`, `isClaudeCodeForDesktopEnabled` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### "Send this machine's settings to cloud sessions" prompt now also mentions sandbox settings The send-settings-to-cloud prompt now also mentions sandbox settings as something that gets skipped. The "send this machine's settings to cloud sessions" confirmation prompt now also mentions sandbox settings: it explains that forwarding skips credential files and anything your Read rules or sandbox settings deny, rather than mentioning only Read rules. - Area: Cloud Sessions - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### MCP toolPolicy simplified: ask-session mode dropped from the wildcard rule docs MCP toolPolicy docs and wildcard logic were simplified by dropping the ask-session case. The long-form docs for `managedMcpServers`' `toolPolicy` were rewritten and simplified. The previous documentation of an "ask-session" clamp — session-scoped "Allow for this task" tool approval with special wildcard precedence rules — no longer appears, and the wildcard precedence logic itself was simplified to remove the special ask-session case. - Area: MCP - Names: `toolPolicy` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### ANTHROPIC_BETAS env var can be blocked by org compliance policy Org compliance policy can now block the ANTHROPIC_BETAS environment variable entirely. When the org-compliance check is active, the `ANTHROPIC_BETAS` environment variable is now ignored entirely instead of being applied, and a debug log records that experimental betas are disabled by org compliance policy. - Area: Elsewhere - Names: `ANTHROPIC_BETAS` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ## Bug Fixes ### Sandbox filesystem glob matching is now case-insensitive on non-Linux platforms Sandbox file rules on Windows and macOS now match paths regardless of letter case. On Windows and macOS, sandbox filesystem allow/deny glob rules now also match using Unicode case-folding (NFD normalize, lowercase, uppercase, NFC normalize) in addition to exact matching, so differently-cased paths referring to the same file are treated consistently. - Area: Sandbox - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Artifact auto-open is now suppressed for remote-control sessions Artifacts no longer auto-open a browser tab when you're driving Claude Code remotely from mobile or web. Artifact auto-open is now suppressed when the session's `messageClientPlatform` is `ios`, `android`, `web_claude_ai`, or `desktop_app`, via a new mode called `auto_open_skipped_remote_control`. The skipped artifact's slug is recorded in a new `remoteControlSkippedSlugs` set, and its deferred-surface entry is kept around instead of cleared, so it can retry surfacing later instead of force-opening a browser tab while Claude Code is being driven from a mobile, web, or desktop remote-control client. This path fires unconditionally, with no experiment flag gating it. - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Rewind now evicts cached file/memory reads for the discarded messages Rewinding a conversation now clears cached file reads so you don't see stale content after rewind. Rewinding a conversation (`rewind_conversation`) now evicts cached file and memory reads tied to the discarded messages instead of just dropping them. Claude Code walks the spliced-off messages, determines which files and which nested `CLAUDE.md`/memory files were read during that span, and clears them from the in-memory read-file cache and from the agent's read-file state via a new `evictNestedMemoryPaths` callback. Previously a later re-read after a rewind could have served stale cached content for files that changed between the original read and the rewind point. - Area: Sessions - Names: `rewind_conversation` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Chat input flushes pending pastes on mount Pastes that arrived before the chat input was ready are no longer dropped. The chat input component now flushes any pending pastes (via `takePendingPastes`) through the paste handler once it mounts and is not hidden or disabled, fixing paste events that arrived before the input was ready to accept them. - Area: Elsewhere - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### MCP server reconnect/config-diff pathway reworked with client cleanup Removed or replaced MCP server clients are now properly cleaned up on config changes. The internal function that applies dynamic/authoritative MCP server config changes (`mcp_set_servers`, `tool_register`, etc.) was restructured to compute a diff via a new merge helper, and now explicitly cleans up removed or replaced clients by calling `cleanup()` on each, which previously did not happen. - Area: MCP - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Ambiguous backslash/parenthesis detection in permission rules Permission rules with ambiguous backslashes, common in Windows paths, now error clearly instead of misparsing. Permission rule validation, such as for `Bash(...)` allow/deny rules, now catches rules where a backslash before a parenthesis is ambiguous, a pattern common in Windows paths, and returns a dedicated error instead of silently misparsing the rule. The error suggests using forward slashes or doubling backslashes and escaping parentheses. - Area: Permissions - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Plugin `$.tool.register` now bounds MCP server connect time Plugin tool registration now times out instead of hanging on a slow MCP server connect. Registering a runtime tool from a plugin via `$.tool.register` now races `addMcpServer` against a timeout constant instead of waiting indefinitely, so a slow or hanging MCP server connect gets aborted rather than blocking the registration forever. - Area: Plugins - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Git checkout now validates .git/info/attributes for cloud-session safety Cloud checkouts now refuse to proceed if git attributes rules could cause inconsistent results. Before doing an index-based checkout, the code now reads `.git/info/attributes` and refuses to proceed if the file is missing, oversized, not a plain file, or sets a filter, working-tree-encoding, or ident rule. Such rules would only be obeyed by this cloud checkout and could otherwise produce inconsistent results; the error message tells you to delete the offending line. - Area: Cloud Sessions - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### New artifact-hosting validation: refuses `` pointing outside the artifact Artifact publishing now refuses pages whose base href points outside the artifact. Artifact publishing now refuses pages whose `` points outside the artifact, such as at another site or the site root, since artifact hosting only serves the artifact's own folder. Depending on whether additional files can still be added to the artifact, the model is told to remove the tag and either publish referenced files alongside the page or inline what the page needs. - Area: Artifacts - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### claude-in-chrome MCP server now adopts into existing connection owner The Chrome MCP server now properly attaches to the session's existing MCP connection owner. The claude-in-chrome MCP server now wires its browser MCP server config into the session's existing MCP connections owner, logging a warning (`no MCP connections owner on this session; the browser tools land on the next reconcile`) if none exists yet and deferring adoption until the next reconcile. A related helper now detects MCP server configs referencing the `--claude-in-chrome-mcp` flag (via command or args), likely to identify the Chrome MCP connector during config processing. - Area: Chrome & Browser - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### New MCP-call-not-sent error states with clearer messaging MCP call failures now clarify when a call never reached the service and is safe to retry. MCP/bridge call failures now distinguish a `stalled_unsent` state from plain `stalled`, covering calls whose upload was withdrawn before leaving the session, with dedicated messaging explaining the call never reached the service and is safe to retry. A related unresolved-delivery message now explains that the outcome could not be confirmed and advises checking whether the call took effect before re-running it. - Area: MCP - Names: `stalled_unsent` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Git dir-sync snapshotting normalizes line endings via merge instead of write-time only Git dir-sync now handles line-ending and merge-driver rules more robustly during snapshotting. Git dir-sync snapshotting has reworked how `.git/info/attributes` line-ending pinning and merge drivers are handled. Merges now explicitly disable configured merge drivers and set `merge.renormalize=false`, and reads of `info/attributes` are now stamp/content-verified rather than judged by a simple pinned/unpinned check. - Area: Cloud Sessions - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Model-name validation now rejects hidden/control characters Model names with hidden or control characters are now rejected before being probed. Before probing a model name against the server, the client now rejects names containing whitespace or Unicode control/format characters, guarding against spoofed or lookalike model names. This check is skipped when going through a gateway or a first-party endpoint that isn't clearly Anthropic's. - Area: Models - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Rewind now tracks files touched via tool calls, not just attachments Rewind now also re-syncs files that were touched via Edit/Write tool calls, not just attachments. `collectRewoundFileTrackingPaths`, which computes which file paths need re-syncing after a conversation rewind, now also scans assistant message `tool_use` blocks (Edit, Write, and notebook-edit-style tools) and adds their file or `notebook_path` targets to the tracked paths. Previously it only tracked file attachments such as images, PDFs, edited text files, and nested or relevant memories. - Area: Sessions - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### File History rewind now tolerates partial restore failures File History rewind now throws an error instead of silently succeeding when all restores fail. Rewinding to a File History snapshot now tracks files that failed to restore (`filesFailed`) separately from files changed and skipped links. If every differing file fails to restore, the rewind now throws an error instead of silently reporting success, and a new failure telemetry event fires in that case. - Area: File History - Names: `filesFailed` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### Redaction of internal task-forwarding markers from transcripts Internal task-forwarding markers are now stripped from transcripts before display. New text-scrubbing helpers now strip internal markers `forwarded_user_turns` and `forwarded_turn` (plus a generic `transcript` marker) out of text before it's shown or sent, using a regex-based redactor together with a new cleanup helper for command display text. - Area: Transcript - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Published-path validation now rejects line/paragraph separator characters Artifact file path validation now also rejects hidden line/paragraph separator characters. The validator for published artifact file paths now also rejects Unicode line-separator (U+2028) and paragraph-separator (U+2029) characters, in addition to the existing checks for control, formatting, and private-use characters. - Area: Artifacts - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Directory-add prompts now also flag sandbox settings failures Sync failure messages now also mention sandbox settings as a possible cause, not just Read rules. Session-sync "unreadable" refusal messages, which previously only cited Read-permission rules as the reason files couldn't sync, now also mention sandbox read-deny settings as a possible cause and list which settings files were unreadable. - Area: Sandbox - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Late-loaded plugins now get session.start events replayed Plugins loaded late now correctly receive the session-start event they previously missed. Plugins loaded after the initial `session.start` dispatch now get that event raised retroactively for them, instead of silently missing it. - Area: Plugins - Names: `session.start` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Malformed/unreadable artifact asset_list and file_list records degrade gracefully Malformed artifact list responses now show a placeholder instead of crashing. Rendering of `asset_list`, `file_list`, and `file_read` tool results now checks the shape of the record before reading its `.assets`, `.files`, or `.size_bytes` fields. A malformed server response now shows text like "listed assets (record unreadable)" instead of throwing. - Area: Artifacts - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### New spawn-hook error: worktree/cwd conflict Spawn hooks setting both cwd and worktree isolation now fail with a clear error. If a plugin's `agent.spawn` hook sets a `cwd` on a spawn that is isolated via a worktree, the launch now fails explicitly with an error stating that `cwd` and `isolation: "worktree"` are mutually exclusive, instead of silently conflicting. - Area: Plugins - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### New spawn-hook error: permission-rule conflicts with rewritten spawn Spawn hooks that conflict with a permission rule now block the launch with an explicit error. If a plugin's `agent.spawn` hook rewrites a spawn into a form that a permission rule would allow, deny, or ask about, Claude Code now detects that conflict explicitly and blocks the launch, telling the caller to dispatch the spawn directly instead. - Area: Plugins - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Fixed agent_empty_result counting for workflow agents Fixed a wrong empty-result count shown in the subagent usage summary. The routine that builds the `` summary block for subagent/workflow runs (``, ``, ``, ``) previously checked `resultPreview` against a stale outer-scope variable instead of the current loop item, which could produce a wrong empty-result count. It now checks `R.resultPreview` on the actual agent being iterated, fixing the `agents_empty_result` count reported in the usage summary. - Area: Subagents - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### list_types now degrades gracefully instead of throwing when the type catalog is off Listing artifact types when the catalog is off no longer throws, just returns empty. Calling the artifact `list_types` action when `frozenArtifactTypes.typeCatalogOn` is not true no longer throws a hard "listing Artifact types is not available in this session" error. It now returns an empty list with an unavailable flag and logs a local telemetry event instead of failing the tool call. - Area: Artifacts - Names: `list_types` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Rewind no longer crashes if file-tracking eviction throws Rewind no longer crashes if clearing cached file state throws an error. `rewindConversationTo` now wraps the call that evicts file-tracking state for rewound messages in a try/catch, logging any error through the standard error handler instead of letting it propagate and potentially abort the rewind. - Area: Sessions - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### MCP manifest validation gains a first-party server name collision check Artifact publish now catches local MCP server names colliding with first-party server names. Artifact publish's MCP host-server manifest validator now detects when a locally-configured server name collides with a first-party server name, rejecting the manifest and reporting it as its own telemetry reason, `first_party_server_collision`. - Area: Artifacts - Names: `first_party_server_collision` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Git remote bridge skips nested GitLab projects for branch tracking Branch tracking now correctly skips nested GitLab projects. The remote-control branch-watching feature now checks whether a git remote is a nested GitLab project before resolving its owner/name, and skips setting up branch/worktree-state tracking for such repos. - Area: Git Integration - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### PATH executable resolution now skips symlinked/broken entries PATH lookup for command completion now skips broken or unsafe symlinked executables. When resolving command names against `PATH` directories for autocompletion and glob-style lookups, candidate paths are now checked with a new async guard that rejects empty paths, certain path shapes, and paths that resolve to symlinks pointing outside an allowed area, before treating them as candidate executables. - Area: Elsewhere - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### GitLab nested-project git sources no longer sent for teleport/bundle Nested GitLab projects are no longer sent as a git source for remote session bundles. When detecting a git remote for background/remote session creation, a nested GitLab project is now treated as null so it is no longer sent as a git source for the remote session bundle. - Area: Sessions - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Artifact read permission: new scratchpad-symlink escape check Artifact reads now specifically catch symlinks that escape the scratchpad sandbox. The Artifact read-tool permission check now separately detects when a published path is a symlink that resolves outside the scratchpad carve-out, rather than treating it the same as a screened/dangerous name. This case requires user approval too, with its own distinct explanatory message. - Area: Artifacts - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### New artifact-publish refusal: local server name collision with first-party server Publishing now refuses when a local MCP server name would conflict with a built-in server name. Publishing an Artifact page now refuses when a declared MCP server name would bind the Claude app's own built-in server while the session also has a local MCP server of that name. The refusal tells the user to rename or remove the conflicting local server, since the page may have been built against a server no viewer can reach. - Area: Artifacts - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Permission rule parser rewritten with clearer error for malformed Tool(content) rules Malformed permission rules now get a clearer, more specific syntax error message. Permission rule validation now classifies malformed `Tool(content)` rules more precisely instead of only checking for balanced parentheses, and reports a rule-syntax-specific error message. - Area: Permissions - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Session-name registry update failures are now surfaced Failed session-name registry updates are now logged instead of failing silently. When a background session's display name updates locally but the shared session-registry record fails to update, Claude Code now logs a warning instead of failing silently, since other sessions could otherwise keep showing the stale name. - Area: Sessions - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Deploy error message for over-budget failures now strips redundant text Over-budget deploy error messages are now cleaner, with redundant text stripped. The 422 `live_over_budget` deploy error handler now trims the server message and strips a redundant pattern from it before truncating, producing a cleaner error message for the user. - Area: Elsewhere - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Chrome extension no longer covers connector directory lookup The Chrome extension disable warning no longer wrongly claims it also disables connector directory lookup. The warning shown when disabling Claude-in-Chrome connector features no longer states that it also disables the connector directory lookup; that feature is no longer described as affected by this toggle. - Area: Chrome & Browser - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Marketplace-not-found errors can now be suppressed when registry read failed Marketplace-not-found errors now surface more often instead of being silently excluded. Plugin validation now excludes `marketplace-not-found` errors only when `registryReadFailed` is not `true`, instead of always excluding them. This means `marketplace-not-found` is now surfaced as a real error in more cases, mirroring the existing handling for plugin-not-installed errors. - Area: Plugins - Names: `registryReadFailed` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Vertex model IDs now validated for illegal characters Custom Vertex model IDs are now validated for illegal characters up front. Custom Vertex AI model IDs are now validated up front and rejected with an explicit error message if they contain `/`, `\`, `?`, `#`, `%`, or whitespace, instead of only checking for the `claude-` prefix. - Area: Elsewhere - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Worktree resume: distinguishing whether binding could actually be cleared Resume now explains clearly when a worktree binding can't be cleared because transcripts are off. When a resumed session's pinned worktree can't be verified and transcript saving is off, Claude Code now says so explicitly: "The worktree binding could not be cleared because transcript saving is off," and suggests using `--fork-session` or starting a new conversation instead of silently clearing or keeping the binding. - Area: Worktrees - Names: `--fork-session` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Permission-ask prompts can now suggest an always-allow rule for standing-approval bash commands The AWS region regex was loosened to accept region prefixes with more than two letters. The AWS region regex used for Bedrock/SSO host derivation now allows one or more lowercase letters at the start of the region prefix (`AWS_REGION_RE = /^[a-z]{2,}(-[a-z]+)+-\d{1,2}$/`), instead of requiring exactly two. - Area: Auth - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Artifact publish/read paths now reject names colliding with the service's own reserved views Artifact publishing now rejects file names colliding with the service's reserved view names. Artifact publish (`files:`) and read (`path`) validation now share a check that rejects file paths colliding with names the artifact service reserves for its own views. Previously only the literal `index.html.json` and leading-underscore names were rejected. The error message explains that such a file could never be read back and suggests renaming it. - Area: Artifacts - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ## In Development ### Agent-intent forwarding to spawned subagents Spawned subagents can now receive recent conversation context forwarded from the coordinator. Spawning a subagent can now forward recent human/relay conversation turns to it as a synthetic `queued_command` attachment called `forwardedIntent`, giving the subagent background context on what the user or channel said to the coordinator, explicitly framed as non-instructional context. This is gated behind an internal check, and it emits `agent_intent_forward` telemetry with turn and character counts, or `select_failed` on error. - Area: Subagents - Names: `forwardedIntent` - Tier: Under the hood - Useful: 3/5 - Signal: 3/5 - Present in the build but not switched on ### extendedQuestionsEnabled added to session config state Extended question types are now gated behind a session-level flag rather than always on. Session config gains `extendedQuestionsEnabled()` and `replaceExtendedQuestionsEnabled()` accessors, gating the extended `AskUserQuestion` fields (`kind`, `min`, `max`, `step`, etc.) behind a session-level flag rather than enabling them unconditionally. - Area: AskUserQuestion - Names: `extendedQuestionsEnabled` - Tier: Nothing to try yet - Useful: 3/5 - Signal: 3/5 - Present in the build but not switched on ### New visibility field for skill/agent-related schema A new visibility field for skills/agents lays groundwork for public/private/internal marking. A schema used for skills/agents-related data now has an optional `visibility` field (`public`, `private`, or `internal`) plus an optional boolean `private` field, laying groundwork for marking these resources with a visibility level. - Area: Skills - Names: `visibility` - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### Policy limits fetched via bearer token, first-party only A new function fetches policy limits via bearer token, but only for first-party accounts behind a gate. A new function fetches "policy limits" using a bearer token in the request's authorization header. It only runs when the account type is first-party and an additional internal gate passes; otherwise it returns `null` immediately without making a request. - Area: Usage & Limits - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### New Dictation configuration surface A voice dictation streaming endpoint is defined but only computed once dictation is enabled. A new `DictationConfig` object and supporting helpers (`dictationBaseUrl`, `websocketCspSource`, `dictationCspSource`, `dictationEndpoints`) derive a dictation streaming/ticket endpoint from the configured gateway inference provider. This requires an `https` or loopback `baseUrl`, an interactive OIDC-less credential, and no optional client auth, and endpoints are only computed when `dictation.enabled` is set. - Area: Dictation - Names: `dictation.enabled` - Tier: Nothing to try yet - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### New 'dictation' core egress service A dictation network service was added to the always-allowed egress group ahead of the feature launching. A new `dictation` entry was added to `EGRESS_SERVICES` with `toggleKey` set to `null`, placing it in the always-allowed core group. Its endpoint is conditionally added from `dictationCsp` (host/scheme) when that value is present. - Area: Dictation - Names: `dictation` - Tier: Nothing to try yet - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### Artifact `get_endpoints`/`call_endpoint` actions renamed and scoped to remote-cowork entrypoints only Renamed endpoint actions remain invisible outside remote-cowork sessions. The artifacts tool's `get_handlers`/`call_handler` actions from the previous build are renamed to `get_endpoints`/`call_endpoint` this release. Their availability, along with `read`, `read_page_data`, `read_db`, `list_files`, and `list_assets`, is still gated behind the same helper, which only returns true when the process's entrypoint is a remote-cowork session, so this functionality remains invisible in normal local CLI usage. - Area: Artifacts - Names: `get_endpoints`, `call_endpoint` - Tier: Nothing to try yet - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### Multi-file artifact publish can now also copy published files between artifacts Multi-file artifact publish can copy published files between artifacts, tracked while still gated off. A multi-file artifact publish's `files` map can now reference another artifact's already-published file to be copied server-side into the new version, instead of only uploading local files. Publish-time validation recognizes a `copy_from_flag_off` failure path, and a distinct `n_copied` telemetry count is recorded when this copy is attempted while the feature is off. - Flag `tengu_cobalt_plinth_samphire`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Tier: Nothing to try yet - Useful: 2/5 - Signal: 2/5 - Present in the build but not switched on ### Provenance-labeled context banners for forwarded intent New banner text will label forwarded context to subagents by where it came from. Three new banner strings label forwarded background context shown to a subagent depending on its provenance: typed by the user, relayed from a messaging channel, or unattributed. Each banner explicitly states that the content is not an instruction to the agent. - Area: Subagents - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 - Present in the build but not switched on ### New 'text'/'number' question kinds behind extendedQuestionsEnabled Text and number question types are gated behind extended questions mode. The clarifying-question tool now supports `kind: "text"` for free-text input and `kind: "number"` for a numeric value, in addition to the existing multiple-choice questions, when `extendedQuestionsEnabled` is active. A choice question with fewer than 2 options is now rejected with a message telling the caller to re-ask it with `"kind": "text"` if it's actually open-ended. - Area: AskUserQuestion - Names: `extendedQuestionsEnabled` - Tier: Nothing to try yet - Useful: 2/5 - Signal: 2/5 - Present in the build but not switched on ### Artifact publishing can copy files from other artifacts, but it's off by default Artifact publishing can copy files from other artifacts server-side, but it's off by default. Artifact publishing can now copy files from another artifact instead of only using local files, via a `copied` list in the publish input with `from_url`/`from_path` entries, or a `files` entry shaped `{artifact, path, ver?}` that copies a published file server-side without downloading and re-uploading it. A separate `copy_from` action accepts `from_url` plus up to a capped number of `asset_ids` to copy assets between artifacts. Validation blocks copying an artifact's own `index.html`, blocks copying HTML/SVG/XML documents entirely, requires `ver` to be a valid version id, and caps the number of distinct source-artifact versions per publish. This whole feature is off by default, gated by a remote flag (`tengu_cobalt_plinth_samphire`) that defaults to false. While off, any attempt to copy returns the fixed refusal "copying files from another artifact is not enabled for this account — nothing was published; publish with local files instead" and logs a `tengu_artifact_publish` event with reason `copy_from_flag_off`. - Flag `tengu_cobalt_plinth_samphire`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Names: `copied`, `copy_from` - Tier: Nothing to try yet - Useful: 2/5 - Signal: 2/5 - Present in the build but not switched on ### MCP startup policy seeding for remote sessions Remote sessions can now seed MCP startup policy state behind a new gate. When Claude Code runs under `CLAUDE_CODE_REMOTE`, MCP server configs can now seed startup policy state, controlled by a new gate. - Flag `tengu_mcp_startup_policy_seed`: Not enough to say (read for one account on one subscription tier against v2.1.260; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: MCP - Names: `CLAUDE_CODE_REMOTE` - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 - Present in the build but not switched on ### New remote-controlled acquire-timeout setting for a lock/queue primitive A lock primitive's timeout can now be remotely tuned, though no server value is set yet. A lock/queue primitive's acquire-timeout handling was replaced by `Wbt()`, which reads a remote numeric setting `tengu_cobalt_plinth_sill` and, if it's a finite number of 0 or more, uses `Math.min(Math.floor(e), L7)` as the timeout. The prior strict input-validator for `opts.acquireTimeoutMs` is gone. `tengu_cobalt_plinth_sill` defaults to null, so absent a server-pushed value, the code falls back to the existing constant `jvn`, leaving the new remote-tunable branch present but unexercised by default. - Flag `tengu_cobalt_plinth_sill`: Not enough to say (read for one account on one subscription tier against v2.1.260; this account: no value returned, anonymous baseline: no value returned, compiled default: no gate table built for this version) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Feature Gates - Names: `tengu_cobalt_plinth_sill` - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ### API client now sends anthropic-beta custom header value only when a flag is on A custom anthropic-beta header can be forwarded, but only once a gate is enabled. Outgoing Anthropic API requests now merge in a header set from a new `Cv()` function, which forwards a custom `anthropic-beta` header from `ANTHROPIC_CUSTOM_HEADERS` only with its value stripped, and only when a gate is enabled; otherwise it returns an empty object. This matches the existing behavior of stripping custom `Authorization` headers. - Area: API Configuration - Names: `ANTHROPIC_CUSTOM_HEADERS` - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ### Copy-from asset language pre-written into upload/read consent prompts Consent prompt wording for copying assets between artifacts is written but not yet shown. Several ask-rule consent messages in the artifacts permission logic are now pre-wired to append wording about approvals also covering "copies of other artifacts' assets" or "copies of them into other artifacts," though this text only renders once the corresponding `copy_from` gate is turned on. - Flag `tengu_cobalt_plinth_samphire`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Names: `copy_from` - Tier: Nothing to try yet - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ### New /diff command toggle wording behind tengu_jazzy_ripple /diff's description wording can change to reflect a toggle, behind an internal flag. The `/diff` command's description text can now read "Toggle the diff panel showing uncommitted changes" instead of "View uncommitted changes and per-turn diffs", depending on an internal flag check. - Flag `tengu_jazzy_ripple`: Not enough to say (read for one account on one subscription tier against v2.1.260; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Diff View - Names: `/diff`, `tengu_jazzy_ripple` - Tier: Nothing to try yet - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ### Chrome install upsell eligibility check reworked Chrome install upsell eligibility logic was reworked, still off by default. The logic deciding whether to show the Chrome install upsell was reworked, replacing an old check with new checks, still gated behind the `tengu_chrome_install_upsell` flag, which defaults off. - Flag `tengu_chrome_install_upsell`: Off by default, switched on for this account (read for one account on one subscription tier against v2.1.260; this account: on, anonymous baseline: on, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Chrome & Browser - Names: `tengu_chrome_install_upsell` - Tier: Nothing to try yet - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ### Remote-tool "standing approvals" capability now checked and threaded through, source of the flag unclear Remote tools can now advertise a standing-approvals capability that Claude Code checks for. A new `standing_approvals` capability string is checked against a remote/MCP host's advertised description and threaded through the permission-suggestion flow as `keepsStandingApprovals`. It gates whether an accepted permission suggestion is offered as an `addRules` suggestion for remote tool calls. This is entirely host-driven, with no local flag controlling it, so it only takes effect once a remote host starts advertising `standing_approvals` in its capabilities. - Area: Permissions - Names: `standing_approvals` - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ### New 'remaining' field on artifact-handover-read result — no traced consumer Artifact handover reads now return unread-line info that nothing currently consumes. The artifact-handover-read function now returns a `remaining` field alongside `artifactRead` and `commit`, populated with unread-line info (`path`, `slug`, `ver`, `lines`, `unterminated`, `unread`) whenever a handover exists, the reader hasn't met the required-lines threshold, and the artifact was handed to that agent. No in-bundle call site currently reads this new field. - Area: Artifacts - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ### New thinking-block-stripping decision during manual compaction, behind an unlaunched flag Manual compaction now decides whether to strip thinking blocks, gated for adaptive thinking only. A new function decides whether to strip thinking blocks from the kept tail of a compacted conversation during manual compaction, and is now actively called, logging a line noting what the kept tail holds. The decision depends on the model's resolved thinking type: only when that type is `"adaptive"` does it consult a feature flag, otherwise stripping stays hardcoded off. - Flag `tengu_wise_comet`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: no gate table built for this version) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Compaction - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ### Reactive-compact "summarize everything" fallback continues to depend on an experiment flag The reactive-compact summarize-all fallback still depends on the same experiment flag as before. The reactive-compact entry point's fallback mode, which splits off a final summarize-all pass once the round-ladder is exhausted, is still gated by an `allowFallback` flag combined with a feature gate check at function entry. This release's rewrite adds `compactionRequestKind` and `groups` params, but the fallback path continues to route through the same gate. - Flag `tengu_hidden_frog`: Not enough to say (read for one account on one subscription tier against v2.1.260; this account: no value returned, anonymous baseline: no value returned, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Compaction - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 - Present in the build but not switched on ## Internal Changes ### New per-group override schema for hybrid (Anthropic-hosted) managed config Hybrid managed config now supports per-group overrides of settings and token limits. Claude Desktop's hybrid (Anthropic-hosted) config server now supports org-level group overrides via a `GroupSettings`/`GroupServableConfig` schema: specific groups, identified by `group_id`, can override a subset of managed-config leaves (`verbatim` scalars, arrays, or objects, or a `nameSubset` restricting the org's `models` list), plus per-group `tokenLimits` (`maxPerWindow`/`windowHours`). Fields refused for hybrid, control-plane-derived, or inference leaves can't carry a group override, enforced by a build-time check that throws on drift. - Area: Admin Settings - Tier: Under the hood - Useful: 3/5 - Signal: 3/5 ### New 'Fable' model-picker entitlement probe with retry/backoff and telemetry A new Fable entitlement probe checks model access with retries and telemetry before offering it. A new 'Fable' probe checks whether the account is entitled to a given model before offering it in the model picker, caching in-flight probes and tracking attempt counts against a cap with retry/backoff. It emits `model_picker_fable_probe` telemetry events with outcomes `accepted`, `refused`, or `failed`, including a `superseded_credential` discard case. - Area: Models - Names: `model_picker_fable_probe` - Tier: Under the hood - Useful: 2/5 - Signal: 3/5 - Present in the build but not switched on ### Bootstrap config intake reworked with fail-closed handling and deprecation reporting Bootstrap config parsing now fails closed on bad keys instead of passing them through. The managed-config bootstrap parser has been reworked to fail closed: keys that fail validation are "stood in" with a safe default (via `onFailClosed`/`standInFailClosed`) rather than passed through. It also reports structured deprecation warnings via `describeDeprecation`, returns additional `sentKeys` and `issueDetails` fields, and distinguishes reader channels such as desktop from others via `isReadBy`/`getFieldMeta`. - Area: Bootstrap Config - Tier: Under the hood - Useful: 3/5 - Signal: 2/5 ### New asset schema fields hint at cross-artifact asset copying New schema fields hint at cross-artifact asset copying, but nothing uses them yet. The asset-list schema gained a `cowritten` boolean field, and a new schema validates a capped list of assets extended with `from_id`. A new zod schema, `asset_copy`, was also added, covering `url`, `from_url`, and an `assets[]` list with `from_id`, `id`, `url`, `size_bytes`, `content_type`, and `sha256`, backing cross-artifact asset copying. No caller constructing or consuming these fields is visible yet. - Area: Artifacts - Names: `asset_copy` - Tier: Under the hood - Useful: 1/5 - Signal: 3/5 - Present in the build but not switched on ### Dictation (voice) config wired into managed-config schema, endpoints unused so far Voice dictation config fields exist in settings schema but nothing uses them yet. A new `dictation` key was added to the managed/MDM config schema, backed by an empty `DictationConfig` placeholder object for future fields. Four helper exports, `dictationBaseUrl`, `dictationCspSource`, `dictationEndpoints`, and `websocketCspSource`, derive a dictation service URL and CSP/websocket origins from the existing gateway inference config, gated on `dictation?.enabled`. These are wired into the config module's exports alongside `isChatTabEnabled`, but nothing in the bundle calls them yet. - Area: Dictation - Names: `dictation` - Tier: Under the hood - Useful: 1/5 - Signal: 3/5 - Present in the build but not switched on ### New bearer-token verification path for Chrome extension policy Chrome extension now verifies the bearer token against org policy to gate the bridge connection itself. Claude in Chrome gained functions to verify the current OAuth bearer token against the `allow_claude_browser_extension` policy, tracking denied/unverified/verified states to gate the browser bridge connection itself rather than just command availability. - Area: Chrome & Browser - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Artifact tool availability now has an explicit off-switch with telemetry Whether the artifact tool is offered now follows an explicit, logged chain of checks. Whether the artifact tool is offered in a session is now decided by an explicit chain of checks: org/session policy (`switched_off`), provider type (`third_party_provider` when not first-party), traffic restrictions (`essential_traffic_only`), an explicit `CLAUDE_CODE_ARTIFACT` env override (`artifact_env_off`), and an SDK default-off case (`sdk_default_off`). Each reason the tool is withheld, and any later recovery, is now logged via telemetry. - Flag `tengu_cobalt_plinth`: Gate removed from the code (read for one account on one subscription tier against v2.1.260; this account: on, anonymous baseline: on, compiled default: no gate table built for this version) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Names: `CLAUDE_CODE_ARTIFACT` - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Background workflow session-restore cache stored with a fixed-shape schema A background workflow session record schema now tracks process kind and identity fields. An internal schema constant previously used for the AWS Bedrock SDK's job-request shape now instead describes background workflow session records, with fields `pid`, `sessionId`, `cwd`, `startedAt`, `version`, `kind` (`interactive`, `bg`, `daemon`, or `daemon-worker`), `entrypoint`, and `pidDomain`. This points to a persisted table tracking Claude Code process instances by kind. - Area: Sessions - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### New localStdinOrigin field threaded through turn dispatch Turns can now be tagged as originating from local stdin input. Command/turn objects now carry a new `localStdinOrigin` field alongside `bridgeOrigin` and `modelScheduledOrigin`, providing a way to tag turns that originated from local stdin input, such as in headless or bridge sessions. - Area: Headless SDK - Names: `localStdinOrigin` - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Turn-lifecycle event hooks added to session loop The session loop now emits turn-start and turn-step lifecycle markers. The headless session loop now emits `turn.start` and `turn.step` lifecycle markers as messages are processed, recording turn events for later use such as intent forwarding's `turnEvents`. - Area: Headless SDK - Names: `turn.start`, `turn.step` - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Hybrid-only bootstrap keys are now dropped outside the hybrid channel Hybrid-only config keys are now dropped when not delivered via the hybrid channel. Bootstrap config keys whose remote policy scope is `only` — meant to be delivered solely by the Anthropic-hosted control plane in hybrid mode — are now explicitly dropped when the bootstrap channel isn't `hybrid`, with a message reported back explaining the key is only honored when delivered by the Anthropic-hosted control plane. - Area: Bootstrap Config - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Profile-credential OAuth path added for the app's own API auth headers API auth can now use a cached OAuth bearer token for eligible enterprise/team profiles. The API auth-header builder now has a new branch that checks a combination of enterprise/team profile eligibility and OAuth scope status, and when satisfied, authenticates using a Bearer token from the cached OAuth credential's `accessToken` plus an `anthropic-beta` header, falling back to the existing API-key lookup otherwise. - Area: Auth - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Session watchdog max-lifetime kill decision can be overridden by a hook A hook can now override whether a background session gets killed at its max lifetime. The background-session runner's max-lifetime timeout now calls an `onMaxLifetime` hook to decide whether to wait or kill the child process, rather than always killing it unless a turn is in flight. If the hook throws, behavior falls back to the previous default. - Area: Sessions - Names: `onMaxLifetime` - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Compaction now decides whether to strip thinking blocks via a 'wise comet' policy Compaction now uses a named policy to decide whether to strip trailing thinking blocks. Compaction now uses a new helper to decide, per-compaction, whether trailing thinking blocks in the kept tail should be stripped, based on the resolved model and thinking type. It logs the decision, whether from an env override, the `thinking_type` default, or a flag, and marks the boundary with a `thinking_stripped` marker when stripping occurs. During reactive compaction, preserved messages now pass through a new step that may strip thinking blocks and insert a marker attachment, with new telemetry fields tracking how many thinking blocks were kept versus stripped and what determined the decision. - Flag `tengu_wise_comet`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: no gate table built for this version) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Compaction - Names: `thinking_stripped` - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### claude.ai URL/slug parsing refactored to support a configurable custom origin Artifact URL parsing now supports a configurable custom origin instead of a hardcoded host. URL-to-slug matching for claude.ai/staging/frame links now goes through a new host-override lookup, allowing a configurable custom origin instead of always assuming the default host. A new `Gp()` helper builds artifact URLs against that override, falling back to `CLAUDE_AI_ORIGIN` when none is set. - Area: Artifacts - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### New internal 'cloud_session_delta' system message for cloud session status A new system message pushes incremental cloud session status updates instead of full re-init. A new SDK system message subtype, `cloud_session_delta`, is written by the headless stream-json client of a cloud-hosted session to push incremental updates covering serving state, connection, in-flight calls, and directory sync between full init snapshots, avoiding the need for a full re-init on each update. - Area: Cloud Sessions - Names: `cloud_session_delta` - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### Asset gateway relay now supports 'copy' operations, not just upload/list/delete The asset gateway relay now supports copy operations alongside upload/list/delete. The session-gateway asset relay now handles asset copy operations in addition to uploads, listing, and deletes. Artifact-service-hosted sessions get an explicit direct-copy fast path (`Dbt()`) outside the relay. - Area: Artifacts - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### System prompt snapshot recording now tracks provenance and hash System prompt snapshotting now tracks provenance and a hash to detect drift. The system prompt snapshot mechanism, used to detect and replay system prompt drift, now tags results with a `source` value of `from_snapshot`, `live_recorded`, or `live_unrecorded`, along with a `snapshotHash`. It also factors in a `hostPrompt` fingerprint that accounts for custom or appended system prompts and whether the session is local, remote, or Chrome-launched. - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### New 'summonSeeds' state for artifact links replaces prior pending-notice tracking Artifact link tracking was reworked with a capped, keyed state structure replacing the old approach. Session state gains a `summonSeeds` object with `open` and `settled` maps keyed by lowercased slug+threadId, capped at a size limit (`lo`) with oldest-entry eviction. New functions `oi`, `njn` (open lookups), and `tjn` (settled lookups) replace the old `shareStatus.pendingNoticeSlugs`-based check for artifact links entirely. A new telemetry name, `tengu_madrone_spindle_corbel`, is defined alongside this rework, though no caller for it is visible yet. - Flag `tengu_madrone_spindle_corbel`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: no gate table built for this version) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Artifacts - Names: `summonSeeds` - Tier: Under the hood - Useful: 2/5 - Signal: 2/5 ### New telemetry events for copy-file refusals during publish New telemetry events cover various copy-file refusal cases during publish. Several new `artifact_publish` telemetry events cover the copy-files feature: refusals for sidecar files on workshop pages, refusals for document types, and refusals for disguised scripts, plus `copy_no_preflight`, `copy_echo_malformed`, `copy_upload_failed`, and `copy_upload_relay_error`. - Area: Artifacts - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### Settings schema metadata gains an m365 config reader and hybrid/remote-only classification Settings metadata now tracks which config fields an M365 integration can read. The internal settings-schema metadata module adds a `CONFIG_READERS` list including a new `m365` reader alongside `desktop`, plus helpers `isRemoteOnly`, `isHybridExcluded`, `isHybridDerived`, `readersOf`, `readersDeclared`, `isReadBy`, and `openEnumItemsOf` for describing which config fields exist and their visibility, redaction, and remote policy. This is plumbing for exposing or restricting settings fields to a Microsoft 365 integration and to hybrid (local+remote) policy scopes. - Area: Admin Settings - Names: `m365` - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### copy_from asset id validation rules copy_from asset ids now have strict validation rules with specific denial messages. Asset ids passed to `copy_from` must be exactly 32-character ids matching `list_assets` output, contain no duplicates, and stay within a fixed per-call cap; violations now produce specific denial messages rather than being silently truncated. - Area: Artifacts - Names: `copy_from` - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ### Publish tool now tracks approved asset-copy sources across a session Publish now tracks approved asset-copy sources per session so consent persists. The artifact publish permission-check path now threads an `approvedCopySources` set, keyed by `toolUseId`, through the publish flow, minted into the tool-call metadata (`copies`) alongside existing path/redirect/sha256 pin data. This is the plumbing that lets `copy_from`'s per-session consent persist without re-prompting. - Area: Artifacts - Names: `copy_from` - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ### Dictation config surface added to session config object Dictation config fields are now exposed on the session config object. The exported session/runtime config object now exposes `dictationBaseUrl`, `dictationCspSource`, `dictationEndpoints`, and `websocketCspSource` fields alongside the existing `isChatTabEnabled`, plumbing network and CSP configuration for a dictation (voice input) feature. - Area: Dictation - Names: `dictationBaseUrl` - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ### New internal flag tengu_teal_corbel_newel A new unclear flag likely affects auto-allow rules for artifact reads. A new gated condition combines several existing checks with a new experiment flag, `tengu_teal_corbel_newel`; its purpose is unclear but it likely relates to auto-allow rule behavior for artifact reads. - Flag `tengu_teal_corbel_newel`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Feature Gates - Names: `tengu_teal_corbel_newel` - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 - Present in the build but not switched on ### Host profile collection has its own telemetry Forced-ask permission decisions now include a suggested standing allow rule where applicable. When building a forced 'ask' permission decision, the code now computes a suggestion via `Cs(e,c)`. If the request `keepsStandingApprovals` and carries a non-empty `suggestions` list, the ask decision includes a `suggestions: [T]` entry proposing an `addRules`/`allow`/`localSettings` rule for the trimmed bash command, instead of just setting `suppressAlwaysAllowRule: true`. `keepsStandingApprovals` is populated from a live call site, `To(n)`. - Area: Permissions - Tier: Under the hood - Useful: 1/5 - Signal: 2/5 ### New "clear view" tracking store in the REPL UI A new internal store tracks where and when the transcript view was cleared. The interactive session UI now instantiates a dedicated store (class `qie`) that tracks where a view-clear happened, recording `clearedAfter`/`conversationKey` against the transcript. It's threaded into the main session component as a new `clearedView` prop and disposed alongside the other session-lifecycle objects when the session ends. - Area: Transcript - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Bridge SDK transcript forwarding now stamps assistant replies to their triggering user message SDK bridge sessions now stamp assistant replies with the user message that triggered them. The `bridge:sdk` transcript-forward logic, used when embedding Claude Code via SDK bridge sessions, now tracks an anchor/`userMessageUuid` pair and calls a new `stampReply` on the bridge object. This associates the eventual assistant reply with the user message that triggered it, rather than just streaming messages as before. - Area: SDK - Names: `stampReply` - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Self-hosted runner session gets lifecycle hooks and current-session tracking Runner sessions gain lifecycle hooks for max-lifetime and termination events. The self-hosted runner's session manager now accepts `onMaxLifetime` and `onTerminating` lifecycle callbacks, and the active session instance is tracked on a ref so other code can check its `terminationRequested` state. The background-result follow-up clear callback also now reports whether termination was requested. - Area: Self-Hosted Runner - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### New streaming latency telemetry fields on SDK turn results SDK turn results now capture finer streaming latency timing for the first content frame. Headless SDK query results now capture finer-grained streaming latency: `first_content_frame_ms` and timing for when the first stream chunk was posted/acknowledged, including wall-clock variants, added alongside the existing ttft metrics. - Area: Headless SDK - Names: `first_content_frame_ms` - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Self-hosted runner sessions get max-lifetime and termination hooks Runner child processes gain max-lifetime and terminating lifecycle callbacks. The self-hosted runner's child process spawn now wires up `onMaxLifetime` and `onChildTerminating` callbacks alongside the existing `onChildLifecycle`/`onChildInit`, so the runner can react when a session hits a max lifetime limit or when a child begins terminating. - Area: Self-Hosted Runner - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### API dispatch requests can now include a side-query header with fallback retry Side-query API requests now retry once without the side-query header on certain failures. Outgoing `beta.messages.create` API dispatch requests may now attach a header identifying the query as a "side query." If such a request fails with a 5xx error, a connection error, or a 408/409/429 with retries remaining, it is retried once without the header or the `maxRetries` override, and telemetry is emitted for the fallback. - Area: API Configuration - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Bedrock/inference config: bearer-token exclusion list added per provider Inference config now has a per-provider list of contexts that should not carry bearer tokens. The inference provider config schema adds a `noBearerFor` list per provider (covering `bedrock`, `vertex`, `foundry`, and Anthropic's `interactive`, `vendor-profile`, `static`, and `helper-script` contexts). A new helper decides whether a credential should carry a bearer token, denying one for OAuth-token-bearing static Anthropic API keys and for `x-api-key` auth schemes. - Area: Auth - Names: `noBearerFor` - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### New "max session age" retirement path for cloud/runner sessions Runner sessions now retire with a distinct max-age reason instead of generic shutdown. Cloud/runner sessions can now retire with a dedicated "max-age" reason (max session age reached), distinct from the existing "shutdown" and "retire" outcomes, with its own "max-session-age grace" period label. The runner's Prometheus metrics now treat a max-session-age release as a clean completion, while hitting the max-lifetime hard cap still counts as an interruption. - Area: Self-Hosted Runner - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Prompt-cache miss telemetry now records a cause Prompt-cache miss telemetry now records the specific reason for the miss. Prompt-cache telemetry now records why a cache miss happened. The tracking data gains `last_miss_cause` (with `tools_added`, `tools_removed`, and `system_char_delta` detail) and `miss_causes`, backed by a lookup table mapping internal cause codes such as `system_prompt_changed`, `betas_changed`, and `ttl_expired_5m` to human-readable strings. - Area: Elsewhere - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Ephemeral event delivery generalized beyond thinking-token updates Ephemeral event delivery is now generalized beyond just thinking-token updates. Ephemeral system-event delivery, previously special-cased for `thinking_tokens` updates, now routes through a general mapper that can deliver other ephemeral system event types the same way, not just thinking-token deltas. - Area: Headless SDK - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Tool-permission rule string parsing reworked to explicit kinds Permission rule string parsing now returns explicit kinds instead of a loose fallback. The parser for permission rule strings like `Tool(args)` now returns a discriminated result of kind `bare`, `malformed`, or `call` instead of always falling back to a bare tool name, and explicitly rejects rule content containing stray parentheses. - Area: Permissions - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Session-forwarding outcome now classified rather than deleted via HTTP Remote session forwarding now classifies outcomes directly instead of using an HTTP DELETE. Remote session forwarding no longer closes a session by sending an HTTP DELETE. Instead, forwarding outcomes are now classified directly: `sent`, `unchanged`, and `conflict_resolved` map to success, while outcomes like `raced`, `lane_full`, `unauthorized`, `deadline`, `failed`, and `aborted` map to failure. This is part of a reworked remote command-forwarding/session-sync path. - Area: Sessions - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### New plugin UI event types ui.input / ui.select Plugin UI gains input/select interaction events alongside existing button press events. Two new plugin-facing UI interaction events, `ui.input` and `ui.select`, have been added alongside the existing `ui.press`, letting a plugin's Input and Select components submit values back through the same handler-chain plumbing used for button presses. - Area: Plugins - Names: `ui.input`, `ui.select` - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Bash/PowerShell telemetry now records whether shell dispatch was user-typed Bash/PowerShell telemetry and sandbox checks now track whether the user typed the command directly. The `tengu_bash_tool_command_executed` and `tengu_powershell_tool_command_executed`/`failed` telemetry events now include a `user_typed_shell_dispatch` field, and sandbox policy checks take a matching `userTypedShellDispatch` flag to distinguish commands the user typed directly from ones issued by a tool. When a command runs through bash-mode dispatch outside a recognized Claude Code session kind, its tool input now carries `userTypedShellDispatch: true`. - Area: Sandbox - Names: `userTypedShellDispatch` - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### New 'get_context_usage' summary detail mode Context-usage requests can now return a lighter summary payload for a memory viewer. Context-usage requests to a remote/cloud session can now request a `summary` detail level via `{ subtype: "get_context_usage", detail: "summary" }`, returning a lighter payload that just enumerates memory file names and token counts for the new memory viewer, separate from the full context payload used by `/context`. - Area: Context Window - Names: `get_context_usage` - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Startup onboarding/dialog sequence rewritten to a step-list runner The startup onboarding sequence was rewritten as a step-list runner, folding in the Chrome policy check. The startup flow covering onboarding, the trust dialog, MCP project approval, CLAUDE.md external includes, the Grove policy dialog, the pro trial screen, powerup discovery, API key approval, Bedrock/Vertex upgrade offers, dev channels, and Claude-in-Chrome offers has been restructured from sequential inline awaits into an array of step functions run by a shared runner (`na`), with per-step early-outs. This is primarily an internal refactor, but it also folds in the new `allow_claude_browser_extension` check. - Area: Terminal UI - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Claude Code usage telemetry now also sent from inside the agent sandbox Usage telemetry can now also be sent from inside the agent sandbox itself. The `anthropic-telemetry` egress service now has a second endpoint, with origin `subprocess`, hitting the same `/api/event_logging/` path, described as usage telemetry sent from inside the agent sandbox. A new `subprocessHostsForServices` helper computes which hosts are reachable from within the sandbox for this purpose. - Area: Telemetry - Tier: Under the hood - Useful: 2/5 - Signal: 1/5 ### Context-window breakdown now separates 'System tools (deferred)' bucket sizing more precisely Context-usage accounting now splits deferred MCP and system tool buckets more precisely. The token-usage breakdown behind the context-usage visualization now tracks deferred MCP tools and deferred system tools as separate categories, each carrying an `isDeferred` flag, alongside a reworked auto-compact threshold calculation. This is an internal accounting change, not a new user-facing toggle. - Area: Context Window - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Attachment/content redaction helper for edits, writes, media and reads A helper now trims large stored payloads from past edits/writes/reads to save space. A new redaction helper can strip sensitive or large payloads from stored tool-call attachments: it nulls out `originalFile` for edits, blanks `content` and `originalFile` for writes, blanks base64 data for image/PDF attachments, and blanks text content for reads when that content matches a companion tool result via a line-numbered diff check. This trims context/storage size for already-delivered read/edit/write results. - Area: Context Window - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New telemetry for artifact tool being withheld/recovered mid-session New telemetry tracks when the artifact tool disappears and reappears mid-session. Two telemetry events, `tengu_artifact_tool_recovered` and `tengu_artifact_tool_withheld`, now track when the artifact tool disappears from a session and reappears. Withholding reasons include `surface_excluded`, `nested_child_session`, `admin_policy`/`subscription_ineligible`, and `switched_off`; this is telemetry only, with no user-facing behavior change. - Area: Artifacts - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Bridge environment registration can now include a host profile Remote environment registration can now include a host's tool and MCP server profile. The `bridge_environment_register` API call used when registering a remote/worker environment can now include a `host` field carrying host tools and the MCP server list, alongside the existing machine, directory, and branch metadata. The debug log now reports tool/MCP counts for that host profile instead of dumping the full object. - Area: Sessions - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New 'summonSeeds' state tracks artifact summon/gesture events A new internal structure tracks artifact summon/gesture events to correlate follow-up replies. A new `summonSeeds` structure tracks artifact summon/gesture events as open/settled slug/threadId/gestureAt tuples with an LRU-style cap, replacing the older `shareStatus.pendingNoticeSlugs` mechanism. It's used to correlate a follow-up artifact interaction, such as a reply, back to the gesture that triggered it. - Area: Artifacts - Names: `summonSeeds` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New telemetry events for artifact tool recovery New telemetry events log when artifact tool calls recover after being withheld. Two new event names were added to the telemetry allowlist for artifact-related tool calls, including `tengu_artifact_tool_recovered`, for tool_use blocks that get retried and succeed after being withheld. - Area: Artifacts - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New unrecognized-model telemetry on /model switch Switching to an unrecognized model now fires its own telemetry event. Attempting to switch to an unrecognized model string now fires the `tengu_set_model_unrecognized` telemetry event, recording the shape of the bad input and whether a suggestion was offered. - Area: Models - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### MCP tool call metadata expanded: conversation_id and compaction_id MCP tool call approvals now carry conversation and compaction IDs for correlation. The permission/approval request schema for MCP tool calls (`ccr_container`/`local_process`) now carries `conversation_id` and `compaction_id` fields alongside `instance_id`, tightening how approvals are correlated back to a specific conversation and compaction state. - Area: MCP - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New default-on flag tengu_gravel_chorus A new default-on internal flag was added with an unclear purpose. A new gate function, `tengu_gravel_chorus`, was added, defaulting to true. - Flag `tengu_gravel_chorus`: Not enough to say (read for one account on one subscription tier against v2.1.260; this account: no value returned, anonymous baseline: no value returned, compiled default: on) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Feature Gates - Names: `tengu_gravel_chorus` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 - Present in the build but not switched on ### Clear-view action emits telemetry event repl_clear_view Clearing the transcript view now logs a telemetry event. Invoking the new clear-view store now logs a `repl_clear_view` telemetry event, letting Anthropic track how often and when users clear their transcript view, separately from other session events. - Area: Transcript - Names: `repl_clear_view` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### MCP client auth-needed marking refactored MCP auth-needed marking was refactored to a simpler call signature. The internal call that marks an MCP client as needing re-authentication now calls `markNeedsAuth(serverName)` on a different object reference with a single argument, instead of the previous two-argument call routed through the `Nt()` accessor. This looks like an internal API consolidation rather than a behavior change. - Area: MCP - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Artifact publish errors gained a maxErrorChars field Artifact publish errors can now be truncated to a server-controlled length. Errors from the artifact-publish flow, including the stale-version guard and publish-conflict errors, now carry a `maxErrorChars` value, indicating the error text shown to the model can be truncated under server control. - Area: Artifacts - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### get_context_usage no longer factors in appendSubagentSystemPrompt Context-usage estimates for embedding hosts no longer count the subagent system-prompt append. The options built for the `get_context_usage` control-protocol subtype no longer include `appendSubagentSystemPrompt` alongside `appendSystemPrompt` and `systemPromptSnapshot`. Context-usage and token estimates reported to embedding hosts no longer account for the subagent system-prompt append when sizing context. The `appendSubagentSystemPrompt` setting itself is unaffected and still used elsewhere, including when building actual prompts; this is a scoped change to the usage-estimation path only. - Area: Context Window - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Artifact file reads/listings can now report a 'from_type' locked content type Artifact file responses can now flag when content type was locked by the artifact's type. Artifact `file_list` and `file_read` tool responses can now include a `from_type` flag, indicating that the served content type was locked by the artifact's declared type rather than sniffed from content. - Area: Artifacts - Names: `from_type` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Artifact 'read' action's inline threshold made configurable The artifact inline-read threshold is now configurable rather than fixed. The threshold below which an artifact `read` action inlines content is now the max of the built-in default and a value from a new helper function, instead of always using the fixed constant. - Area: Artifacts - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Artifact read now passes a files-listed hint for artifact reads Artifact reads now pass a hint indicating whether files were already listed. Artifact `read` action calls now pass a `filesListed` hint, derived from a new helper, indicating whether the artifact's files have already been enumerated. - Area: Artifacts - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New gate replaces hardcoded-off feature switch A helper that always returned false now checks a remote gate first. The internal helper `ar()`, which previously always returned false, now checks the `tengu_ochre_bittern` remote-config gate first and falls back to false only if the gate is off. - Flag `tengu_ochre_bittern`: Off in both readings (read for one account on one subscription tier against v2.1.260; this account: off, anonymous baseline: off, compiled default: off) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Feature Gates - Names: `tengu_ochre_bittern` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 - Present in the build but not switched on ### New localStdinOrigin option threaded through prompt processing Prompt processing now forwards the local-stdin origin tag. The prompt-processing call in headless sessions now accepts and forwards a `localStdinOrigin` field, alongside existing origin-tracking fields like `bridgeOrigin` and `modelScheduledOrigin`. - Area: Headless SDK - Names: `localStdinOrigin` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Headers field redaction changed from 'drop' to 'presence' Web search server headers now redact as 'presence' instead of being dropped entirely. The MCP builtin websearch server's `headers` field now redacts as `presence` instead of dropping the value entirely, so config/telemetry snapshots record that headers were set without fully discarding the field. - Area: MCP - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New telemetry for asset copy operations New telemetry tracks asset copy requests and rejects same-artifact copies. A new `artifact_asset_copy` telemetry event tracks asset copy requests. It validates slug formats, rejects copies where the source and destination artifact are the same (`same_artifact`), and caps the number of ids allowed per copy. - Area: Artifacts - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New telemetry event tracks sandbox filesystem rule sync completeness New telemetry tracks completeness of sandbox filesystem rule syncing. A new function computes sandbox deny-read rules, credential file rules, and 'reopen' (`allowRead`) rules across all settings sources, and fires a `tengu_dir_sync_upload_rules` telemetry event summarizing the counts and completeness of that computation, deduplicated by payload hash. - Area: Sandbox - Names: `tengu_dir_sync_upload_rules` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Legacy string-encoded key/value config values now get a deprecation notice Legacy string-encoded config values now get flagged for scheduled deprecation. A new `legacyKvEncodingNotice` helper flags managed-config fields that still accept the old `"Name=value,…"` string or `["Name: value", …]` array encodings instead of a JSON object, tagging them for a scheduled deprecation batch. - Area: Admin Settings - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### REPL bridge exposes a stampBridgeReply hook The REPL bridge hook gains a stampBridgeReply function. The remote-control REPL bridge hook now also returns a `stampBridgeReply` function, which forwards to the underlying binding's `stampReply` method, alongside the existing `sendBridgeResult`. - Area: Remote Control - Names: `stampBridgeReply` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New description text for Bedrock/gateway auth config fields Bedrock auth settings now document exactly which env var each is passed as. Settings fields `inferenceBedrockProfile`, `inferenceBedrockAwsDir`, `inferenceBedrockAwsCliPath`, and `inferenceBedrockRegion` now have explicit `description.short` text stating exactly which environment variable each is passed to the helper script as, for example `AWS_PROFILE` or `AWS_CONFIG_FILE`. - Area: Bedrock - Names: `AWS_PROFILE`, `AWS_CONFIG_FILE` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### AskUserQuestion telemetry can include extended per-question fields and a title AskUserQuestion telemetry can now capture extended per-question fields and a title. Telemetry for `AskUserQuestion` can now capture more detail per question: when a gate function returns true, `kind`, `description`, `placeholder`, `min`, `max`, `step`, `default`, and `unit` fields are serialized, and a `[title: ...]` prefix is prepended from the question's title. - Area: AskUserQuestion - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### MCP client registry gains a 'connections' accessor slot The MCP client registry gains centralized connection registration accessors. The internal MCP server-state class, which already tracked approved servers, a clients accessor, connected-client wiring, and a tools swapper, now also exposes `registerConnections`, `acquireConnections`, and `connections()`, so MCP connection objects can be centrally registered rather than looked up ad hoc. - Area: MCP - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Remote-tools stalled-call telemetry distinguishes taken-back vs cancelled Stalled remote-tool call telemetry now distinguishes taken-back from cancelled outcomes. When a remote-tools call stalls past its deadline, internal telemetry now records more specific outcomes: whether the call was taken back before any write carried it, or cancelled while a write was already in flight. A new `unconfirmed` outcome (`write_unresolved`) is also recorded when the carrying write never resolves by the deadline. - Area: Elsewhere - Names: `write_unresolved` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New 'taken back' state for stalled session liveness checks Session liveness checks gain a distinct taken-back state instead of generic stalled. Session liveness and probe results gained a `taken_back` variant alongside `stalled`, surfaced as `takenBack: true` on the stalled result. Run and monitor completion messages can now report a task as something other than 'stopped' via a lookup table when it was taken back. - Area: Sessions - Names: `taken_back` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New session-release reason for max-age expiry Session releases from hitting max age are now tracked as their own outcome. The self-hosted runner's session release/retire state machine gained distinct `released_false_max_age` and `released_false_max_age_parked` outcomes, so a session release triggered by hitting a max-age limit is now tracked separately from the existing shutting-down and retiring outcomes. - Area: Self-Hosted Runner - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Plugin cache-miss diagnostics now record install path and seed-version conflicts Plugin cache-miss diagnostics now record the actual install path and version conflicts. Plugin cache-miss diagnostics (for non-command sources) now include the actual install path, or a fallback constant, instead of always showing "(not recorded)", plus new `registryReadFailed` and `seedHasOtherVersion` flags when applicable. - Area: Plugins - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Claude in Chrome tool guidance rewritten as inline instructions Chrome tool guidance for the model is now inline instead of a separate file reference. The tool-use guidance for Claude in Chrome is now inline instead of file-referenced. It tells the model that Claude-in-Chrome tools need no separate enabling if present (identified by names containing `claude-in-chrome` or `Claude_in_Chrome`), with fallback guidance to use `Claude_Browser`-named tools or tell the user Chrome isn't connected. - Area: Chrome & Browser - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New allowlist of dev-toolchain binaries A new allowlist recognizes common dev-toolchain binaries by name. A new allowlist of dev-toolchain binary names has been added, covering `xcodebuild`, `swift`, `swiftc`, `xcrun`, `git`, `make`, `clang`, `clang++`, `gcc`, `g++`, `python3`, and `pip3`. - Area: Elsewhere - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New CONFIG_RELAUNCH_IDLE_MINUTES export A new constant for config relaunch idle minutes was added. A new `CONFIG_RELAUNCH_IDLE_MINUTES` constant has been added to the shared config module. - Area: Admin Settings - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 - Present in the build but not switched on ### New env vars added to pass-through/deletion allowlists Two new env vars were added to internal forwarding and auth-token handling lists. Two new environment variables, `CLAUDE_CODE_FORWARD_USER_INTENT` and `CLAUDE_CODE_MCP_SERVE_AUTH_TOKEN`, have been added to internal handling lists, the former governing subprocess/child env forwarding and the latter serving as an auth token for `claude mcp serve`. - Area: Elsewhere - Names: `CLAUDE_CODE_FORWARD_USER_INTENT` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Compaction requests now tagged as auto vs manual Compaction requests are now tagged as auto or manual. Context-compaction requests now carry a `compactionRequestKind` field set to `auto` or `manual` depending on whether compaction was triggered automatically or by the user. - Area: Compaction - Names: `compactionRequestKind` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Stale-catalog flag added to plugin/skill catalog telemetry Plugin/skill catalog telemetry now flags whether the fetched catalog was stale. Plugin/skill catalog-fetch telemetry now records a `stale` boolean flag alongside the existing `source` (`fallback`/`served`/`published`) and `fetchedAt` fields, distinguishing stale cached catalogs from freshly served ones. - Area: Plugins - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Bedrock/Mantle requests now send an additional shared header set Bedrock/Mantle requests now send an additional shared header block. Outgoing requests to the Bedrock and Mantle providers now merge in an additional shared header block on top of the existing headers. This applies across all auth code paths, including API key, skip-auth, profile bearer, and credential-chain paths. - Area: Bedrock - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### No-op stub tools explain that Chrome browser tools need no enabling No-op stub tools tell the model Chrome browser tools need no separate enabling step. Two new no-op stub tools, `enable__mcp__claude-in-chrome` and a generic 'Browser' variant, do nothing when called. They exist to tell the model that if tools named with `Claude_Browser` are already present in the session, they're already usable, so the model should use those directly instead of wasting a call trying to "enable" them. - Area: Chrome & Browser - Names: `enable__mcp__claude-in-chrome` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Detailed file-sync timing guidance added for remote/subagent workflows New guidance text explains exactly when synced edits reach a remote host. New helper text explains exactly when edits made in a synced local copy reach a remote host: at turn end, just before each remote call, or mid-task. It also clarifies that output from remote-run commands must be read on the remote host itself rather than assumed to already be synced locally. - Area: Sessions - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New git/credentials guidance for remote-host tool descriptions Remote host guidance now clarifies credentials are never copied to the local environment. Remote host status text now explicitly tells the model that SSH keys, commit-signing keys, git credential helpers, and `gh` login are never copied into the local environment. It instructs running `git push`/`pull`, signed commits, and `gh` operations on the remote host itself rather than asking the user for a token. - Area: Sessions - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Remote tool-call reply handling now supports withdrawing queued asks Queued remote tool-call asks can now be withdrawn client-side instead of only cancelled. The remote tool-call reply resolver now supports a `withdrawable` option, letting a queued-but-undelivered ask be withdrawn client-side instead of only cancelled. Settlement now distinguishes a `takenBack` outcome ("stalled, takenBack") from a plain cancel. - Area: Elsewhere - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New request header added to Anthropic API/Bedrock client requests A new default header set is now added to Anthropic/Bedrock API requests. Requests across the bearer, apiKey, and AWS-bearer-token code paths in Anthropic client construction now include a new set of default headers, `Cv()`, spread in alongside the existing `Em()` headers. - Area: API Configuration - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Managed MCP server list now capped at 100 entries Stalled remote approvals taken back before sending now get a distinct error code. The remote-tool approval path now surfaces a `stalled_unsent` error code for a stalled approval request that was taken back before being sent, distinct from the prior generic `stalled` code. - Area: MCP - Names: `stalled_unsent` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Event-loop stall detector's expected interval now differs for remote sessions The event-loop stall detector uses a different expected interval for remote sessions. The event-loop stall detector now uses a different expected monitoring interval when running in a remote-controlled Claude Code session (`CLAUDE_CODE_REMOTE`) instead of the same constant used everywhere else. - Area: Sessions - Names: `CLAUDE_CODE_REMOTE` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Self-hosted runner now distinguishes idle-release at max session age Runner sessions released for hitting max age now get their own telemetry tag. Self-hosted runner sessions released for hitting the maximum session age are now logged and tagged in telemetry as `released_false_max_age`, instead of being lumped in with plain idle releases under the generic `released_false`. - Area: Self-Hosted Runner - Names: `released_false_max_age` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Narration generation now distinguishes a 'truncated' outcome Status-line narration that gets cut off by max tokens is now tracked as its own outcome. When the model call that generates the status-line narration hits `stop_reason: "max_tokens"`, it's now classified as a distinct `truncated` outcome with its own telemetry, rather than being treated as a generic failure. - Area: Background Tasks - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### CCR (background worker) client: tool results can be blanked/trimmed before upload Background-worker uploads now trim tool results before sending, with telemetry if blanked. Events uploaded by the background-worker (CCR) client now pass `tool_use_result` content through an upload-trim step before sending; if trimming blanks out the result, a one-time `ccr_tool_result_blank` telemetry event fires. Transcript uploads also gain a separate "envelope strip" step. - Area: Sessions - Names: `ccr_tool_result_blank` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### CCR client: transcript envelope stripping telemetry Background-worker transcript uploads now strip an internal envelope wrapper, logged once. When the CCR client writes internal events, a payload transform can strip an 'envelope' wrapper from transcript entries, and the first time this actually changes a payload it logs a `ccr_worker_envelope_strip` telemetry event. - Area: Sessions - Names: `ccr_worker_envelope_strip` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Gateway desktop bootstrap config now flags deprecated keys explicitly Desktop bootstrap config validation now explicitly flags deprecated keys. Desktop-bootstrap config validation used by the Claude Code gateway gains a new `deprecated` diagnostic kind, produced by a new `detectDeprecations`/`describeDeprecation` pass separate from the existing unknown/refused-key logic. Mapping a legacy flat key back to its canonical name now goes through `flatConfigKeys`/`getFieldMeta(...).legacyFlatKey` instead of the old `resolveLegacyFlatKeys`. - Area: Bootstrap Config - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### First-frame upload tracking added to turn streaming Turn streaming can now track when the first non-thinking frame was uploaded. Turn streaming now supports an optional `trackFirstFrameUpload` callback, invoked on the first non-thinking `stream_event` of a turn. It can also attach `user_message_uuid` to `thinking_tokens` system events. - Area: Headless SDK - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Vertex credential kind renamed from "oauth" to "interactive" Vertex's credential kind label was renamed from oauth to interactive. The Vertex AI credential kind literal is renamed from `"oauth"` to `"interactive"`, aligning it with other providers' naming. `deriveInferenceCredentialKind` now also returns `"interactive"` for the Vertex OAuth client ID case. - Area: Auth - Names: `interactive` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5 ### Claude in Chrome MCP server config now recognizes DCR OAuth mode as not-BYO Chrome MCP config now determines bring-your-own-auth status by checking for non-DCR mode. The Claude in Chrome MCP server config now determines bring-your-own-auth-server status by checking `t.oauth.mode !== "dcr"` instead of checking for `mode === "byo"`. MCP OAuth entries using dynamic client registration (`dcr` mode) are no longer treated as bring-your-own-auth-server for egress-hostname purposes. - Area: Chrome & Browser - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### job_delete telemetry now records whether worktree discard was confirmed Job deletion telemetry now records whether worktree discard was actually confirmed. `job_delete` telemetry events, for both the worktree-left-in-place path and the default path, now include a `discard_confirmed` field (`discardConfirmed` on the delete-session return value) reflecting whether the user confirmed discarding a worktree. - Area: Sessions - Names: `discard_confirmed` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New telemetry event for failed rewinds A new telemetry event logs when a file-history rewind fails entirely. A new `tengu_file_history_rewind_failed` telemetry event is emitted, with `trackedFilesCount`, `filesFailedCount`, and `skippedLinksCount`, when a rewind fails because no files could be restored. - Area: File History - Names: `tengu_file_history_rewind_failed` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New telemetry gate for CCR upload trimming A new telemetry gate fires when background-worker upload trimming occurs. Client/worker request config now wires an `uploadTrim` callback that fires the telemetry event `tengu_ccr_upload_trim`, joining the existing reactivation-beat and heartbeat-skip telemetry hooks. - Flag `tengu_ccr_upload_trim`: Not enough to say (read for one account on one subscription tier against v2.1.260; this account: no value returned, anonymous baseline: no value returned, compiled default: no gate table built for this version) These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release. - Area: Sessions - Names: `tengu_ccr_upload_trim` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### New trusted-context check for claude_browser frame relay A new helper checks whether a browser context is already trusted for frame relay purposes. A helper `UJe` now compares a context string against a hard-coded list (currently just `claude_browser`), using a normalized (lowercased, alnum-only) match, and this is used to decide whether a browser context is treated as an already-trusted host in the artifact frame relay's bot-context logic. - Area: Chrome & Browser - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### hostPrompt field threaded through plugin/skill tool schema A new hostPrompt field is now threaded through plugin/skill tool schema building. A new optional `hostPrompt` field was added to the plugin-loaded prompt-snapshot schema and is now propagated through skill/tool description building, alongside `systemPrompt` and `tools`. - Area: Plugins - Names: `hostPrompt` - Tier: Under the hood - Useful: 1/5 - Signal: 1/5 ### Plugin state management refactored into a dedicated store class Plugin state management was consolidated into a dedicated store class. Plugin state updates — errors, warnings, `needsRefresh`, marketplace installation status, and applying a refresh — are now centralized in a dedicated store class with explicit methods (`addErrors`, `addWarnings`, `markNeedsRefresh`, `setPendingMarketplaces`, `setMarketplaceStatus`, `applyRefresh`), replacing inline state-object spreads in the plugin-refresh pipeline. - Area: Plugins - Tier: Under the hood - Useful: 2/5 - Signal: 0/5 ### Terminal control-mode tracking centralized into a mode-set class Terminal escape-sequence state handling was centralized into one mode-set class. Terminal escape-sequence state, covering bracketed paste, theme reports, extended keys, alt screen, alt-screen keys, mouse tracking, background color queries, and focus events, is now tracked by a single ordered mode-set class with `set`/`reset`/`suspend`/`resume` operations, replacing ad hoc raw writes scattered through the render and raw-mode code. This is an internal restructuring of how terminal modes are entered, exited, and restored (for example on suspend/resume when shelling out or exiting) rather than a user-facing change. - Area: Terminal UI - Tier: Under the hood - Useful: 2/5 - Signal: 0/5 ### Minor formatting fix in worktree-removal tool result Worktree-removal result formatting was cleaned up with no behavior change. The object literal for the worktree `remove` tool-result payload (`originalCwd`, `worktreePath`, `worktreeBranch`, `discardedFiles`, `discardedCommits`, `message`) was reindented and cleaned up. This is a formatting fix only, with no behavior change. - Area: Worktrees - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### Transcript turn summary rendering refactor Turn summary rendering code was refactored internally with no visible change. The component that renders per-turn summaries (edits, scratchpad edits, workshop edits, thinking duration, and git commit/push/branch/PR status) was refactored internally, with a new helper consolidating repeated feature-check calls. What's displayed, including edit counts, "Ran N PreToolUse hooks", "Recalled" memory entries, and commit/push/branch/PR status lines, is unchanged. - Area: Transcript - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### /sandbox command now declares explicit requirements metadata /sandbox now declares metadata marking it as interactive-only, no workspace required. The `/sandbox` command now declares explicit requirements metadata, marking itself as interactive (ink) UI only and as not requiring a workspace, matching the pattern used by other local-jsx commands. This affects command availability checks rather than any user-visible text. - Area: Sandbox - Names: `/sandbox` - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### ExitWorktree tool restructured to session-scoped create() pattern The ExitWorktree tool was restructured to a session-scoped factory pattern, no behavior change. The `ExitWorktree` tool's `validateInput`/`call` logic now lives behind a `create(e)` factory, matching the pattern used elsewhere for session-bound tools. This is an internal restructuring; the existing worktree-removal safety checks, covering uncommitted changes, commit counts, and ownership, are unchanged. - Area: Worktrees - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### Permission-denied MCP tool errors now mark the MCP client as needing auth via session wiring MCP auth-needed marking on permission errors was refactored, no behavior change expected. When a tool call throws an MCP permission-denied/auth error, the code now marks the client as needing auth through `session.mcpSessionWiring.connections()?.markNeedsAuth(...)` instead of dynamically importing a helper module. This is an internal refactor of how MCP auth-needed state propagates, with no behavior change expected. - Area: MCP - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### New hasUnknownModelCost / narration block indexes plumbing Internal cost/narration telemetry fields were refactored with no clear user effect. The `hasUnknownModelCost` schema field is now built through a helper rather than declared inline, and a new helper computes `narration_block_indexes` from an array. Both are internal cost/narration telemetry changes with no clear user-facing effect. - Area: Elsewhere - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### Eval-suite result schema gained partial-run reasons Internal eval-suite results now record why a run was only partial. The internal eval-suite result schema used by Claude Code's own evaluation tooling now records whether a run was partial and why, with reasons covering `cost_ceiling`, `interrupted`, and `auth_failed`, along with a schema version field. - Area: Elsewhere - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### Git diff stat/numstat calls consolidated onto a shared flag array Git diff calls for telemetry were consolidated onto shared flags, no behavior change. The several git diff invocations used for change-summary telemetry, numstat, shortstat, and hunk diffing, now share a common flag array instead of each repeating `--no-optional-locks -c diff.relative=false diff` inline. Behavior is unchanged. - Area: Git Integration - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### Push-notification and connector-search tools refactored to a create()-based lazy-injection pattern Several tools were refactored to a lazy dependency-injection factory pattern. The send-notification, connector search/lookup/list, remote-trigger management, and project tools were restructured from a flat `call(e,t)` signature to a `create({credentials, mcpClients, ...})` factory that returns `call`/`checkPermissions` closures. This is an internal dependency-injection change with no described behavior difference. - Area: Elsewhere - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### /context fullscreen detection changed /context now checks fullscreen state directly instead of via a heuristic. The `/context` command now decides whether to collapse detail sections by checking `i.presentation === "fullscreen"` directly, replacing the prior `xt()` heuristic function. - Area: Context Window - Names: `/context` - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### Worktree-session cleanup on resume consolidated into a shared helper Worktree cleanup logic on resume was consolidated into a shared helper. The worktree-session cleanup logic that runs on `--resume` (both the fork and normal paths) is now consolidated into a shared `lf` helper taking `{persist, storageV5}`, replacing duplicated inline code. Behavior such as printing worktree-gone messages and persisting bindings is preserved but centralized. - Area: Worktrees - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ### Stdin key-parsing loop rewritten as pure functions Stdin key-parsing was rewritten as pure functions, functionally equivalent. The terminal input reader's handling of incomplete escape sequences, including mouse-prefix drop timers, paste mode, and byte-run deadlines, has been refactored from mutable instance-method state into pure functions that thread an explicit reader state object. This centralizes logic previously duplicated between `flushIncomplete` and `processInput` and is functionally equivalent. - Area: Terminal UI - Tier: Under the hood - Useful: 1/5 - Signal: 0/5 ## Removed ### cd-then-read deny-rule circuit breaker removed Bash no longer warns before cd-ing into a directory covered by a Read deny rule. The safety check that intercepted Bash commands doing `cd` into a directory and asked the user before running when a subsequent `Read()` deny rule would cover files under that directory has been removed entirely. That prompt no longer fires. - Area: Bash Tool - Tier: You'll notice - Useful: 3/5 - Signal: 2/5 ### "ask-session" tool policy value deprecated for built-in tools The 'ask-session' tool policy value is deprecated and now just rewritten to 'ask'. Setting a `builtinToolPolicy` entry to `"ask-session"` is now a formally deprecated value. It is flagged via `BUILTIN_TOOL_POLICY_ASK_SESSION` and is rewritten and read back as `"ask"`. - Area: Permissions - Names: `builtinToolPolicy`, `ask-session` - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### anthropic-mcp-registry egress service removed The MCP registry egress service entry was removed from the egress allowlist system. The `anthropic-mcp-registry` egress service entry, which covered the mcp-registry and api/directory hosts under `disableNonessentialServices`, has been removed from `EGRESS_SERVICES`. - Area: Sandbox - Tier: You'll notice - Useful: 2/5 - Signal: 1/5 ### `copy_from` artifact action deprecated in favor of publish+from_url The copy_from artifact action is deprecated in favor of publish with from_url. References to the `copy_from` artifact action are now rewritten with guidance to use `publish` with `asset: true` and `from_url` instead, joining the existing `delete_asset` rewrite rule. - Area: Artifacts - Names: `copy_from`, `from_url` - Tier: You'll notice - Useful: 1/5 - Signal: 1/5