Claude Code v2.1.267

When --allowedTools is given but doesn't match any known built-in tool, Claude Code now recognizes this as a session with built-in tools entirely disabled, and passes that state through its permission logic. Plugins are explicitly blocked from registering any of their own tools in that case.

Artifact publishing (deploying) failures now come with much more specific error messages. A large new table of reason codes, covering cases like audience_conflict, capability_refused, contract_refused, not_owner, read_timeout, deadline_invalid, and live_path_cap, drives custom explanatory text instead of a small set of generic hardcoded checks. A new deadline_invalid case automatically retries the request with its deadline field removed, and errors about specific declared capabilities now get their own tailored messages.

Artifacts (the standalone documents, apps, or games Claude can create and show alongside a conversation) can now be republished with updates that reach any viewers already open, without the reader having to reopen or refresh them.

Where possible, the update carries over the current state of the page, such as a game in progress, a queued action, or a reply that has been half-typed but not sent.

When Claude Code reads a file, new internal logic detects the file's text encoding (distinguishing UTF-16LE from UTF-8 by checking for a byte-order mark), then scans for the first replacement character (the symbol that appears when a byte sequence can't be properly decoded as text) or the first byte that can't be decoded at all. If either is found, the read now returns a structured result identifying the problem kind, the encoding, and the exact line and column where it occurs, instead of just returning garbled text.

When Claude Code builds the list of comments to forward for an artifact's automatic reaction feature, it now also includes comments from team members (not just the artifact's owner), when a related setting is enabled. These team-member comments are tagged with source: "unattributed" and get a projectsRow marker plus extra fields. Owner comments are also now cross-checked against a lookup of earlier comments to reuse an earlier authored version and timestamp when appropriate.

When Claude Code asks permission to write to an artifact's underlying storage (write_db), it now classifies the write as one of four cases: cowritten, from_type, someone_else, or unknown, based on who owns the file. The permission prompt can now be prepended with a description of the file, such as saving a file as a given name or saving a named file to a given location.

It also separately calls out a version-pinned write to someone else's artifact (an edit that targets a specific saved version rather than the latest one): this kind of write always asks for permission on its own, and approving it only covers that one write, until the current conversation has read that artifact's data.

The internal system that tracks changes across a conversation's checkpoints used to only follow artifact tool calls. It now also follows file write and edit tool calls, and reports a kind of either 'artifact' or 'file' for each tracked change. It also counts failed edits (an edit that tried to replace text that didn't match) in a new editsFailed counter, and returns a kept list showing which artifacts are still the final version at the point in the conversation being examined.

Claude Code tracks how close you are to hitting rate limits (caps on how much you can use the service in a given period). It now also keeps a rolling local record of recently-seen rate-limit windows, and can use that record to fill in the displayed status when a fresh reading from the server isn't available at that moment.

When Claude Code figures out which tools a spawned subagent is allowed to use, it now also includes machine-level MCP (Model Context Protocol, a standard for connecting external tools) tools, in addition to the app-state MCP tools and the tools an agent explicitly declares. This applies both to subagent spawning generally and to the workflow SDK's agent tool-set resolution, and the machine-level tool list is now merged in when building skill tool sets as well.

The internal prompt that interprets forwarded or human-authored messages for background and cloud agents now recognizes a new category: a message written by the owner of the Claude Code Project a session belongs to, posted on that project's timeline. When present, this message is treated as if the session's own user wrote it, and it can clear a SOFT BLOCK rule for the exact action it names.

This new behavior comes with limits:

• it cannot answer a pending permission prompt
• it cannot authorize changes to permission settings or to CLAUDE.md
• a bare "yes" or "ok" clears nothing unless the block was already visible when the owner wrote the message

For commands and prompts that come from plugins, Claude Code now only labels them with 'org' scope when the plugin's source repository is found in a specific trusted set provided by the caller. Previously, plugin-sourced items were always mapped to 'org' scope, the same way items from 'managed' or 'synced' sources are. Now, if the repository isn't in that trusted set, the scope comes back undefined instead.

Two new warnings appear when resolving a saved session reference for send_message:

• another live session on the same machine currently claims the same identity as the target, which could mean impersonation or a duplicate open conversation
• the target session has restarted since it was last reached (same session, but a new process)

Both warnings advise checking with the user before sending anything sensitive.

CLAUDE_CODE_NONBLOCKING_STDOUT makes Claude Code write terminal output through a second, non-blocking channel so a stalled terminal (like a paused tmux pane or a frozen SSH connection) can't freeze the session. Previously this only applied when the environment variable was explicitly set. Now, if the environment variable isn't set, Claude Code also checks a remote server-controlled setting, tengu_event_loop_stall, as well as an internal first-party check, to decide whether to enable it.

When Claude Code runs commands in a sandbox (a restricted environment that limits what a command can access), clipboard tools like pbcopy, xclip, or wl-copy don't work because they can't reach the system clipboard from inside it. Claude's instructions now tell it that when this happens, it should put the text in a fenced code block and tell the user to run /copy themselves, rather than writing the text to a file for the user to copy manually.

The /copy command copies the last assistant response to the clipboard from outside the sandbox; when code blocks are present it shows an interactive picker so the user can select just the block they want, or press w to write the selection to a file instead, which is useful over SSH.

When an artifact's comment thread is too large to include in full, Claude Code trims it down. Previously this was a flat character cutoff across the whole rendered comment. Now each comment's header line is kept separate from its body when trimming, and any trailing partial line that matches the quoted-line prefix is removed entirely rather than left cut off mid-line.

A plugin's hooks.json file (which defines hooks — scripts that run automatically at certain points, like before a tool runs) is now checked against an allow-list of valid keys. If it contains keys that aren't recognized, or if a hook entry is missing its required matcher or hooks fields, Claude Code now emits a warning listing the offending keys, summarizing with "... and N more" if there are many.

The message shown when a spend cap is hit now distinguishes a channel-scoped cap from the general one. Hitting a channel's own monthly limit now shows "You've hit your channel's monthly spend limit," separate from the existing "You've hit your monthly spend limit" message.

Claude Code can reload a plugin's hooks (scripts that run automatically at certain points, like before a tool call) without restarting. Previously this hot-reload only triggered when the managed policy settings changed. It now also triggers when user settings change, if doing so moves a setting between the managed and user configuration tiers.

Claude Code runs hooks (custom scripts that run at certain points, like before or after a tool call) in a separate worker process. A background daemon checks that this worker is still alive by sending it periodic heartbeat pings and waiting for a response. Previously, a single unanswered ping (based on how much time had passed) was enough to declare the worker wedged. Now the daemon counts consecutive missed heartbeats and only declares the worker stuck once that count crosses a threshold.

The panel that appears above the prompt box had its keyboard shortcuts changed. Previously, the up and down arrow keys doubled as aliases for moving to the next or previous item in that panel. Now up, down, page up, page down, home, and end are bound instead to dedicated scrolling actions: scroll up, scroll down, page up, page down, jump to top, and jump to bottom. The description of this keybinding scope was also updated to refer to a 'panel' above the prompt rather than just a button.

When Claude Code explains why an unsupported batch write can't proceed, it now takes into account whether the batch is version-pinned. For a version-pinned batch, the message says it will only be applied all-or-nothing if the server supports batch writes; otherwise it's refused entirely, since 'a version-pinned batch is never applied one at a time'. This replaces the previous message, which described a one-at-a-time fallback.

When Claude Code builds web-page Artifacts, the prompt guiding the model now includes more detailed responsive-design instructions:

• Keep the page usable at widths as small as roughly 400px
• Keep 16px side margins using padding-block (never a padding shorthand that zeroes it out)
• Use relative units instead of fixed pixel sizes
• Let grids wrap or stack on narrow screens
• Cap the width of images and elements with a fixed aspect ratio
• Confine any horizontal scrolling to tables, diagrams, or code blocks, each in its own scrolling container, so the page body itself never scrolls sideways

The 'Usage stats' feature now carries an explicit note that it is not shown for organizations under HIPAA regulation. The reason given is that these stats are built by scanning session transcripts saved locally on the machine.

The Button element type used in plugin user-interface code now conditionally passes along a hover property when handling a press, if one is set.

Claude Code now shows a distinct error message when a tool from an MCP server (a connector that lets Claude use external tools and data) isn't available for the current session: "[server]'s MCP tools are not available in this session right now; [tool] did not run." This is separate from the existing message that suggests the server may have disconnected.

When Claude Code starts in headless (non-interactive, scripted) mode, it fetches a catalog of available models over the network. Now, before doing that fetch, it checks a saved marker recording whether a recent headless fetch failed. If a failure was recorded recently, it skips the network call entirely and falls back to the built-in model list, recording the reason as headless_held_off.

Success and failure are tracked in a new .headless-failed.json marker file, and repeated failures make Claude Code wait longer before trying again (exponential backoff).

When Claude Code tries to send a message to another peer or agent session by name and can't find that name, the error message now checks whether that session was renamed, and if so, tells you its current name.

The dialog that shows usage statistics (similar to the /stats command) now first checks whether it is allowed to load, using an allowed/reason pair from a store. If it isn't allowed, it shows the given reason text instead of fetching and displaying all-time and active-time usage figures.

In message lists where replies are shown under a speaker label (such as in bridged or teammate sessions), consecutive messages from the same labelled speaker are now tracked as "continuing" that reply. Instead of repeating the label for each one, Claude Code now draws a connector line down the left edge to visually link them.

When an organization's compliance policy strips beta headers from ANTHROPIC_CUSTOM_HEADERS or ANTHROPIC_BETAS (environment variables used to opt into experimental Anthropic API features), the debug log message changed from "disabled by org compliance policy" to "disabled by your organization's policy."

When an organization's policy disables Projects (uploading or reading project files to claude.ai), the message shown now just says the feature is 'disabled by your organization's policy.' Previously the message specifically called out 'compliance policy (e.g. HIPAA)' as an example reason.

Two new footer hint strings were added to the terminal UI:

• a 'band' widget hint: arrows, page up, and page down scroll, tab moves, and escape returns to the prompt
• a 'scrollingButton' widget hint: enter presses the button, and arrows scroll

The error message shown when a plugin entry helper, declared through remote-managed settings, hasn't yet been approved for the current session was reworded.

The configuration for the five-hour and seven-day rate-limit thresholds no longer includes a claimAbbrev field, which previously held short labels like "5h" and "7d".

Several messages shown to users or written to logs have been reworded to replace references to "compliance" or "org compliance policy" with "organization's policy". This includes the message shown when model-chosen URL access is blocked, the message logged when CLAUDE_CODE_EXTRA_BODY content is dropped, and the message logged when SDK betas are dropped.

When a requested effort level (a setting that controls how much reasoning Claude puts into a task) exceeds the allowed maximum, the warning message now says the cap can come from "your settings or organization", rather than blaming the organization alone.

When a higher reasoning-effort level (how much the model "thinks" before answering) isn't available to you, Claude Code now says "Higher effort levels are capped by your settings or organization" instead of a version that placed the blame solely on your organization.

When the artifact tool rejects a label field that is too long, the message it shows now just says label is a short name (max 60 characters), instead of describing it as a short version name.

The validation logic for the availableModels setting, which restricts which models people can pick, had a bug: it was reading from and writing to internal variables that didn't match its own inputs, so it wasn't actually validating the list it was given. This has been fixed so it correctly checks the input array and only keeps valid string entries.

When computing which actions are allowed for an artifact with live editing turned on (liveEditOn), Claude Code now only grants the "sync" action. It previously also granted "version" automatically in this case.

The policy checks that run on agent.spawn and tool.call events now actively restore certain pinned fields if a hook rewrite changed them: the parent agent ID and related fields for agent.spawn, and the agent ID for tool.call. Previously these checks only flagged a mismatch rather than fixing it.

When publishing an artifact's files fails, Claude Code's publish status panel now shows a red "Couldn't publish its files" message along with the specific reason, instead of failing silently or less visibly. Session state also now tracks crashedPublishChecks and frozenHotUpdate.

When Claude Code validates a plugin's hook configuration, it already checked the hook's module path for path traversal (an attempt to reference files outside the intended directory, e.g. using ../) and existence. It now performs the same checks on the hook's surfacePath as well, returning a path-traversal or path-not-found error if it fails.

When publishing or deploying an artifact and the upload connection drops partway through sending the request body, Claude Code now detects this using byte-tracking data and automatically resends the request once over a fresh connection. It logs a warning when this happens, along with a deploy_resent telemetry event recording the outcome of the retry.

Claude Code now detects when a plugin's hook matcher (the on() condition that decides when a hook runs) is structurally wrong, such as using an object matcher against a value that can only be a scalar, and logs a one-time warning per file path explaining the mismatch, capped at 32 warnings per module and event to avoid log spam.

It also now logs when a hooks module's own hook is skipped, or has some of its registrations left out, because that module is already being dispatched (re-entry protection), naming the chain of nested hook calls that led there.

When a text-type file is validated for publishing to an Artifact, content containing the Unicode replacement character (U+FFFD, the symbol that appears when text can't be decoded properly) or an unpaired surrogate (a broken piece of a multi-part character) is now rejected with a specific error. For HTML files, the error also explains that the character should be escaped as � instead.

When multiple machines are connected in a shared session and one machine owns a particular MCP tool (a tool exposed by a Model Context Protocol server), a new wrapper now catches attempts to run that tool from a different machine and throws a clear error explaining that the tool belongs to that other session and can't run locally.

The check for the allow_remote_control policy was rewritten as a switch statement over the correct, properly-scoped variable, replacing a reference to a different, apparently mistakenly-named variable that looks like it was a leftover typo or scoping bug.

The logic that decides whether to log and retry an error after a failed request used to recognize connection_error, server_overload, api_timeout, and rate_limit. It now also recognizes stream_idle_timeout, logging "API {type} after retries" and treating it the same way as those other transient errors.

The label shown above an artifact now reads "File: " when the item is a file, and "Artifact: " otherwise. Previously it always said "Artifact" regardless of kind, and the underlying code referenced an undefined variable, meaning the distinction never actually worked.

When the cleanup process for revoked credentials fails, it used to return nothing at all, leaving callers with no information. Now, on failure, it returns a synthesized result that marks every credential name as revoked with a fixed cause code, giving callers something usable instead of an empty result.

When previewing an artifact (an HTML or text file), Claude Code now runs the underlying bytes through a decoder that detects encoding problems before rendering. If the bytes can't be decoded, or decoding required inserting replacement characters, the preview now fails with a specific error (preview_source_encoding or preview_source_replacement_char) instead of blindly converting the bytes to text and possibly rendering garbled or misleading content.

In the diff/checkpoint viewer, the toggle that expands a collapsed list of changed files to "show more" previously always forced the list open no matter its current state, because the underlying handler always returned true. It now correctly returns the opposite of the current state, so clicking it again collapses the list back.

When Claude Code detects that a turn was interrupted, it used to insert a placeholder marking the turn as incomplete. New logic now checks for a run of trailing "caveat" user messages, and if one is present, it either skips inserting that placeholder or treats the turn as already complete.

When publishing an artifact (a generated file or document Claude Code creates and sends to a server), the server can reject the request with an HTTP 422 error. The retry logic that double-checks and resends after such a rejection now specifically recognizes a content_pending error code from the server, using a new step that extracts the status code from the response. Previously it only had a generic fallback for 422 responses it didn't recognize.

When working in a remote session, tools that belong to that session's own MCP servers (external tool connections tied to a specific machine) are now represented by a placeholder. If something tries to call one of these tools directly instead of properly routing the call to the right machine, it now throws a specific error instead of silently running incorrectly on the wrong machine.

Claude Code now strips any afk-mode value out of the beta-feature list in a custom CLAUDE_CODE_EXTRA_BODY (an environment variable that merges extra fields into every API request). If you had set that beta yourself, it's now removed automatically with a warning, because only Claude Code's own auto mode is allowed to send it.

When Claude Code sets up a plugin's symlinks (shortcuts that point to another file), it now checks that the symlink and its resolved target are actually the same file, by comparing their inode and device numbers (low-level filesystem identifiers). A symlink is now rejected if it points somewhere different than it appears to resolve to, or if this identity can't be verified at all.

If a plugin marketplace directory's path can't be reliably resolved to its real location (for example, because it contains a backslash on a non-Windows system), Claude Code no longer simply refuses to read it. Instead, it walks the directory tree one component at a time, checking each step to make sure it's a plain directory and not a symlink. Where the path can be resolved normally, entries are still checked by comparing their filesystem identity against the marketplace root, as before.

When Claude Code hot-reloads plugin hook modules (updating them without a full restart), it now waits for the reload to finish and then checks whether the environment host process died partway through. If it did, the reload is aborted with an error instead of being committed.

When an artifact operation fails with a files_error, the tool result returned to the model no longer carries the is_error flag that previously marked it as an error result.

When an Artifact is created from a type_url (a type-based template), Claude Code already stripped out several fields that don't belong on that kind of creation, such as url, pr_review, capabilities, contract, lang, and force. Now deadline is rejected the same way.

When Claude Code's automatic permission system (which decides whether a tool call needs to ask you first) can't get a verdict, it now shows a specific message when the cause was the model's response being truncated (cut off) mid tool-call, rather than a generic error. Several other distinct "no verdict" error codes were also merged into one shared code, server_unavailable_error.

Claude Code can show announcement banners in its status area, some of which are marked internal-only ('ant-only') and meant only for Anthropic staff. Demo builds of the app now always get an empty list for those internal-only announcements, so they're never shown.

When a plugin marketplace entry's file path fails Claude Code's containment check, the explanation now also flags paths containing backslashes as invalid, in addition to the previously flagged absolute paths, paths that climb out of their directory, network-shaped paths, and paths that traverse symlinks.

Claude Code's terminal renderer uses an "alt screen" (a separate full-screen display terminals use for interactive apps). When that alt screen is handed off (handoffAltScreen()) or deactivated, Claude Code now calls endPointerCapture() and tellPressedNowhere() before resetting terminal modes and repainting.

When Claude Code handles Ctrl-C (SIGINT) to shut down MCP servers, the cleanup code used a guard flag to prevent the cleanup from running twice. Due to a bug, it checked one variable but set a different, unrelated one, so the guard never actually took effect. It now correctly sets the same flag it checks.

A short-circuit check used during skill verification now checks the set that was actually just built for that check, instead of mistakenly checking a different, out-of-scope variable.

When Claude Code figures out where a block of speaker-labelled messages begins in the transcript, it now keeps stepping backward through as many consecutive 'labelled reply' messages as there are, using a new helper. Before, it would only ever step back a single position.

A path-safety check now also treats a path as unsafe if it contains a backslash (\) while running on an operating system other than Windows, in addition to its existing checks.

When Claude Code checks whether a bash command's file arguments are covered by your allowed read paths, it used to stop and report as soon as it hit the first argument that failed the check. It now keeps checking every argument and reports the first problem found only after examining them all. It also now skips paths that already match an allowed pattern before falling back to checking whether the file actually exists on disk.

Before relaunching the CLI as a child process, and before resuming after the process is suspended and continued (SIGTSTP/SIGCONT), Claude Code now explicitly calls a helper to uninstall a previously-installed hook that intercepts writes to standard output. Previously these paths either skipped this step or used a different, non-equivalent function.

The tengu_sdk_session_crash telemetry event now serializes and logs the exception that was actually caught, instead of an apparently unrelated variable that was being logged before.

When looking up or searching connectors (integrations Claude Code can use, such as external tools registered with it) fails, the error handling now checks whether the error is already the registry's own error type. If it is, that original error is passed through as-is. Previously, it would always be caught and wrapped in a brand-new generic error, which lost the original error's message and type. The classes and logger involved were also renamed internally.

When Claude Code refreshes its internal policy-limits data, it now always clears the on-disk cache file and drops any unconfirmed session cache, no matter whether the account currently qualifies for policy limits. Previously, if the eligibility check failed, the whole refresh step was skipped and the old cache file was left in place. Now only the reload-and-log step that follows is skipped for ineligible accounts; the cache deletion always happens.

Headless sessions, meaning ones run with -p or through the SDK without the interactive terminal interface, now expose a compact() method, but calling it currently always fails with an explanatory error. That's because compaction in headless mode currently only happens inside a turn, triggered by a /compact prompt, not through a separate method call.

A new internal check reads the tengu_session_stable_address setting and uses it in several places that determine session IDs and derived secrets, such as choosing whether to hash a value or generate random bytes, and whether a 'derived' source should still be treated as valid.

When publishing an artifact, Claude Code can now resolve a template kind called heli, joining the existing kinds pr_review, workshop, whiteboard, prototype, and plain. A new capability object checks whether the page or slug being published is bound to Heli, and if so, a noteHeliPublish call records the publish event.

A new internal feature, referred to as "projects owner rows forwarding," forwards credit for rows that come from queued commands or attachments authored by an "owner," tagged with the telemetry label auto_mode_projects_owner_rows. It only runs when two internal conditions are both true, and it's automatically disabled when the session has an agent ID, a teammate context, a certain session-state result, or the CLAUDE_CODE_CHILD_SESSION environment variable set (which marks a session as a subprocess Claude Code itself spawned).

A new check detects when another live process on the same machine is already listening on the socket that represents this session's "stable address" (its identity), even though it's a different process. When that happens, the /list-agents (also /peers) output changes which address token it displays for this session's own entry, to reflect that its usual address is shadowed by the other process.