Claude Code v2.1.268

The header now shows a small status indicator for the REPL bridge, the connection Claude Code uses for Remote Control. It reflects whether the bridge is connected, reconnecting, in an error state, or has a session active. It only appears when the terminal window is at least 60 columns wide, and it does not show when Remote Control is running in outbound-only mode.

New machinery renders human-readable permission cards for actions on artifacts, such as uploading, copying, or editing, derived from the reasoning behind a tool's decision. Alongside this, two new checks deny requests to read a local file from outside a Cowork session's connected folders, through a link, or when the file simply can't be read.

Claude Code Projects let a Claude Code agent follow a shared timeline of messages. The built-in instructions describing how those timeline messages reach the agent now also cover projects with multiple members, rather than assuming a single project owner. When relaying a timeline message, the generated marker now states whether the message's author was the project owner or a regular member, including that person's account id.

The default list of git push commands Claude Code will run without asking permission is now built by checking your actual git remotes: it keeps origin if present, and adds remote.pushDefault if it names a single valid remote. It then expands this into allow-list entries for git push <remote> * and git push -u <remote> *, plus a certified form, for every default allow-list used across the app.

Environment variables defined in an env block inside settings.json now go through a validation step before Claude Code applies them. Entries are stripped out, with a one-time warning logged per settings scope, if:

• the key isn't a valid environment-variable name
• the value isn't a string, number, or boolean
• the value contains a NUL character

When resuming an in-process teammate (a background agent running as part of a multi-agent team), Claude Code now checks whether the folder that its custom agent definition came from is trusted. If it isn't, the custom definition is no longer restored: the teammate falls back to only the team-essential tools and no custom instructions, and an error is logged (agent_type_untrusted) explaining that the user needs to run Claude Code in that folder and accept the trust dialog.

Claude Code now recognizes a new reason a session can be blocked: verification_required, alongside the existing auth, billing, and context-limit reasons. It shows the label "organization verification required" and carries the error code cleared_verification_required, with matching handling added to the logic that classifies why an operation was blocked, the code that handles API errors, and the screen shown when a session is blocked.

Before moving a session to the cloud ('teleport'), Claude Code now looks up the project's git remote, and if it points to GitHub, kicks off a check in the background to confirm access to that repository. If that check finds GitHub isn't connected, or the repository can't be found, the teleport is stopped immediately with a specific message instead of failing later once it reaches the server.

When a permission rule is written against a file path that turns out to be a symlink, Claude Code now also resolves that path to its real, canonical location on disk, and adds an equivalent rule for that resolved "physical twin" path. This applies to deny rules during permission-rule compilation.

When a cloud or remote session needs to clone a repository but no GitHub account is linked to your Claude account, Claude Code now shows a dedicated message explaining this and pointing you to the fix: /web-setup if your local CLI already has a GitHub login, or the web connect-github page otherwise.

When Claude Code lists available tools from an MCP server that uses the 'http' transport, it now does so inside an isolated context that has background tasks and unsandboxed (unrestricted) command execution turned off. This restriction is skipped if those things are already disabled globally.

When the artifact tool's list_files and read_file actions handle a file that is "type-locked" (tied to a specific artifact type), Claude Code now looks up that type's metadata and includes it as a type field in the response, alongside the existing from_type flag. The read action also now records type_named in its internal telemetry when the artifact has a title.

When Claude Code can't fully parse the structure of a bash command to check permissions, it now runs a secondary check that scans the raw command text for cd directory changes and file reads, comparing any resulting paths against configured Read/Edit deny rules. This only runs when deny rules are actually configured. If this fallback check itself fails, the failure is logged as "semantics-path deny check failed" and Claude Code falls back to asking the user.

Claude Code's classification of errors coming back from the Anthropic API now includes a distinct verification_required category. It is checked before the existing repeated_529 check, and sits alongside other existing categories like rate_limit, capacity_off_switch, and prompt_too_long.

The internal bridge_session_get helper, used to fetch a session over the bridge, now checks upfront whether the active provider is Anthropic itself (first-party). If it isn't, the fetch is refused immediately, returning session:null and logging a new telemetry reason (bridge_session_get_3p_provider). Separately, this helper gained a useV2 override option, so it no longer always derives whether to use the V2 path solely from isCcrV2SessionCrudEnabled.

Artifact "wake subscriptions" (which let a session be woken up by activity on an artifact) now report a specific new failure reason, session_device_bound, when the cloud session is tied to the desktop that started it, such as through Cowork or claude --cloud. This happens because of a trusted-device check, and it's now fully wired up: parsed from the server's response, shown to the user with a specific message, and checked at another point in the code.

When Claude Code's fast safety classifier blocks some content, it now tries to pull a <category> tag out of the classifier's raw response. If that category matches one of a known set, the refusal message now shows a bracketed category name (like [category name]) instead of always showing the same generic fallback message.

When Claude Code records telemetry for a tool call, it normally attaches detail fields like file_path, full_command, skill_name, and subagent_type. This now only happens when an additional check passes; in sessions where that check comes back true, none of these detailed fields are attached to the telemetry payload.

The WorktreeRemove hook, which can run when a worktree is being removed at session exit, when a subagent finishes, or when you delete a background session, now returns a structured result instead of a simple yes/no: not_configured, removed, or failed, each with a summary. If the hook reports failure or gives no output but the worktree directory is confirmed gone anyway, Claude Code now treats the removal as successful rather than reporting a failure.

When Claude Code encounters a model name it doesn't recognize, it used to reject it right away if it didn't match a known shape. Now, if the unrecognized name is classified as an "other" shape and is short enough, it's allowed to fall through to further allowed/blocked checks instead of being rejected on the spot.

When Claude Code's directory-sync feature decides whether it's safe to run git in a synced checkout, it now takes a fingerprint of each git config file (its device, inode, size, and change time, plus a hash for small files, following symlinks) both before and after reading it. If the fingerprint changed during the read, or a follow-up check shows the config changed since it was read, Claude Code now refuses to run git there rather than trusting a config that might have been altered mid-read.

When a tool call is restricted to a sandbox network list and carries allowed_domains under the relevant sandbox mode, Claude Code's permission check now forces the decision to "ask" rather than letting an allow rule or hook approve it silently. The message explains that allow rules and hook approvals cover the command itself but not the specific hosts it's allowed to reach, and that only the auto-mode classifier can approve the allowed_domains list.

The function that builds the MCP server and tool name fields for telemetry previously sent nothing at all when the user hadn't consented to sharing full names. Now, in that same no-consent case, it sends hashed versions of the server name and tool name (mcpServerNameHash and mcpToolNameHash) instead of omitting the fields entirely.

When Claude Code displays or logs an MCP server's configuration, sensitive parts are now masked first. For servers connected over HTTP or SSE, headers are replaced with [REDACTED]. For servers run as local processes (stdio), environment variable values are replaced with [REDACTED] and command-line arguments are cleared. The server's URL or command itself also goes through a separate masking step. This applies to the mcp status, mcp list, and mcp get commands, as well as configuration diffs.

When Claude Code lists or reads files through the artifacts tool, the response text can now say the file comes from "an Artifact of type X" when the artifact has a declared type, rather than describing it as a plain artifact.

Entries in allowedDomains and deniedDomains (the sandbox's network allow/deny lists) must now be a real domain name, a single-level wildcard like *.example.com, localhost, or a bracketed IPv6 address. Overly broad patterns such as a bare * or *.com are rejected for allowedDomains; deniedDomains still allows a bare * since that means "deny everything".

The message shown when 1M-token context usage credits are required now explicitly says that turning credits on only takes effect in a new session or after restarting Claude Code, rather than sounding like it applies immediately.

In the plugin marketplace/details screen, Claude Code now identifies which MCP client (a connected tool or integration) the currently selected item belongs to, and computes a summary of any configuration warnings for that client.

When Claude Code shows an error banner for an API error of the kind "organization verification required," it can now include a clickable link in addition to the plain text message.

When the filesystem sandbox (the mechanism that confines what files a command can read or write) is set to 'relaxed' mode, the permission-prompt summary no longer lists specific allowed and denied directories. Instead it plainly states that the sandbox does not confine commands to particular directories for reading or writing. Configured working and deny paths are still shown, but only as informational context. The summary also reminds Claude to leave Claude Code's own configuration, hooks, and skills, as well as git's hooks and configuration, untouched unless specifically asked to change them.

The bridge relay client used for the Chrome DevTools connection gained two new methods: pushExternalConfigToPeer(deviceId, config) and pushExternalConfigToAllPeers(config). Messages sent over the bridge now carry a target_device_id. When a pairing event ('paired') occurs, the client now calls pushExternalConfigToAllPeers() to update every connected peer, instead of only updating whichever device was currently selected. A newly connected peer also receives its own targeted push.

When an Artifact (a piece of generated content Claude Code manages, like a shared document or canvas) declares a shared store, Claude Code gives the model guidance on how to write to it. That guidance now takes into account whether the artifact's type actually declares any endpoints (ways to write to the store). If it doesn't, the model is now told plainly that no store-write call is available for that type, rather than being pointed toward run_script as a possible option regardless.

When a memory file (such as CLAUDE.md) or its index gets truncated for being too long, the warning message now states exactly which line the cut started at, and where possible, quotes the first roughly 80 characters of that line.

The upload_image tool's description was rewritten to narrow its scope: it now only accepts screenshots taken via the computer tool's screenshot action, not images a user has directly uploaded. It states that screenshot IDs expire a few minutes after being captured, so a screenshot should be uploaded right after it's taken. It also tells Claude not to reuse the ID from a failed upload, instead retaking the screenshot and retrying at most once, and never retrying after a user has declined. For files a user has attached, Claude is told to use file_upload instead.

WebFetch (the tool Claude Code uses to retrieve a URL) now throws a specific error when the requested URL's hostname has no dot in it, such as localhost or a bare hostname. The error tells the user to use curl via the Bash tool instead. The tool's own description was also updated with this caveat.

When Claude Code starts up and reports on managed settings (organization-provided configuration), it now also collects and prints non-error "notices" under their own "Managed settings notices:" heading, separate from the existing reporting of fatal errors and invalid entries.

The status report shown by /plugin (and claude mcp) now adds the text "required by your org" next to a plugin's status line when that plugin is enabled and your organization's settings mark it as required. This is shown alongside the existing statuses for disabled plugins, plugins that loaded with errors, and plugins that loaded normally.

The built-in guidance Claude Code follows when committing changes or creating pull requests now includes a warning to stage files by name rather than using git add -A or git add ..

When Claude Code checks whether a requested model can be used, it now tells the difference between a permission problem and a generic API error. If your account simply doesn't have access to the model you asked for, you'll now see a specific message: "Model '...' isn't available for your account."

The check that decides whether live or reseed publishing options are available for an artifact now tests the content type against a set of allowed values instead of requiring it to be exactly text/html.

A new helper detects when changes to plugins (add-ons that extend Claude Code) need a reload to take effect, and reports it as either "deferred" or "queued" via telemetry. When a response is still being generated, Claude Code now shows: "Plugin changes apply when the current response finishes (/reload-plugins is queued)."

When Claude Code figures out which git remotes to grant push permission for (so it can suggest a rule like git push origin *), it now returns multiple candidate remotes instead of picking just one. It includes origin when present, plus whatever remote is configured as remote.pushDefault, as long as that name fits an expected naming pattern.

When a background monitor watching a running bash command times out, Claude Code used to show a flat "[Monitor timed out — re-arm if needed.]" message. Now the message reports how much time passed and how many events the monitor actually delivered before it expired, or says plainly that no events were delivered. Monitors also gained a way to flush pending events and count how many have fired, plus a "bounded"/"quiet" mode that can flush accumulated output right before the timeout fires instead of just cutting off.

When publishing an artifact and copying a file into it (whether given as a plain source string, a {from, ...} entry, or a {artifact, path} copy), Claude Code now works out the file's content type from where it's being placed, combined with any content type you explicitly set. Previously, the content type was only recorded when you specified it yourself via {from, contentType}; otherwise it wasn't carried through at all.

Artifacts can save files (read_asset requests) outside the session's normal working folders, but only with the user's approval. In sessions where there's no way to show that approval prompt at all — such as Cowork or local-agent sessions running without a live user to ask — this request is now automatically denied instead of falling through to whatever the previous logic happened to produce.

The screen shown when logging in via OAuth fails now looks for a URL at the end of the error message and, if found, displays it as a clickable link rather than as plain text. The screen also gained a verbatim mode, which shows the raw error message as-is without prefixing it with "OAuth error:".

When a teleport to the cloud fails or is blocked on a precondition, the error message now suggests running /web-setup (which connects your GitHub account using your local gh CLI login) to reuse your existing GitHub CLI login, then tells you to rerun /teleport (which pulls a Claude Code on the web session into your terminal).

When an MCP server (a connected external tool server) needs authentication, Claude Code now keeps track of which servers it has already flagged to you, both for the current session and persisted across sessions (with a cap on how many are remembered). Once a server successfully connects, it is cleared from that list.

Permission-request prompts (the ones asking whether to allow a tool action) can now render as a structured "card": a bold question, informational lines, and values that are dimmed and truncated to fit the available width, with a "… (+N more lines)" indicator when content is cut off. The prompt display checks whether this card layout fits within a height budget before using it, falling back to the old plain-text rendering if it doesn't fit.

When a message references a file using an @-mention but that file was never actually read, Claude Code now renders it distinctly as 'Referenced (not read)', listing the mentioned names.

The login flow now recognizes a new error type, VerificationRequiredError. When this specific error occurs, Claude Code marks it to be shown verbatim, meaning the original error message is displayed exactly as received rather than being reformatted or summarized.

When a git clone, fetch, or checkout fails while installing a plugin or marketplace, Claude Code used to show the raw error text from git, which can include the full remote repository URL and sometimes embedded credentials. Error messages are now passed through a redaction step that masks the URL before it's shown to the user or written to logs. A related helper produces a safe version of the URL for log lines like git clone: url=....

The field parameter used by write_db's str_replace operation used to be validated with a simple regular expression. It's now checked against an explicit length bound of 1 to 200 bytes plus a named rule: the field must name a single top-level key, with no dots, slashes, brackets, quotes, backslashes, control characters, or invisible formatting characters, and it can't be the reserved __name__ key.

Claude Code can generate a summary recap of what happened while you were away (after the terminal window was blurred/unfocused). This generator now tracks how many times in a row it has failed during a given turn and stops trying again once it fails three times. It also skips starting a new generation if one is already in progress. The way this background work is saved and tracked internally was also reworked.

When you enable, disable, update, or uninstall a plugin, or disable/uninstall one via a settings file, Claude Code used to always append the fixed instruction "Run /reload-plugins to apply." to the confirmation message. That fixed text is now gone, replaced by a fragment that is supplied separately depending on the situation.

When Claude Code fetches the server-provided list of models and gets back an error response, it now parses the error body to check whether the problem is credential-related. If so, it appends '(this credential cannot read the served list)' to the logged message and returns this more specific error, instead of a generic HTTP-status error.

The function that produced specific error messages for failed Chrome-extension bridge tool calls (distinguishing timeouts, disconnects, and generic errors, each with its own troubleshooting advice) has been replaced with a generic timeout wrapper that just races the call against a timeout and returns a plain fallback value.

When you submit a followup to a feedback survey, Claude Code now builds the data it sends from a fixed list of named fields: latestAssistantMessageId, message_count, datetime, description, surface, platform, gitRepo, commitSha, remoteWorkspace, remoteSessionId, version, transcript, subagentTranscripts, rawTranscriptJsonl, recentSessionTranscripts, and debugLog. Previously the submission passed through whatever object it was given.

When reporting the status of a background task, Claude Code now checks which tools are available to it. If that check fails, the report omits the output file path, forcing the task to report back only via SendMessage rather than pointing to a saved output file. This is in addition to an existing check based on webFetchSavedFiles.

When creating an API key via OAuth fails, Claude Code now checks the underlying error response for a verification-required condition. If found, it throws a specific error carrying that detail instead of falling through to the previous generic 'request failed' error.

When Claude Code validates per-model cost settings (input, output, cache-read, cache-write pricing), a cost value now must be no greater than 10,000. Previously any positive finite number was accepted; a config with a cost figure above 10,000 now fails validation instead of being allowed through.

The code that builds the error message shown when a deny rule blocks reading or copying from an artifact was consolidated into one shared helper, which now produces one of three phrasings depending on the situation: "Copying from this artifact is", "Artifact reads are", or "Reading this artifact is" blocked by a rule. A separate new helper also checks whether a fetched artifact's capabilities include a headless comment flag.

When Claude Code logs in via OAuth, it opens a temporary local web server to receive the login callback and needs a free network port for it. The function that picks this port now takes a configurable range and fallback port instead of hardcoded values.

• If no port in the configured range is free, and the fallback port is also taken, Claude Code now tries one more thing: asking the operating system to hand it any free port, before giving up.

When Claude Code creates a remote or cloud headless session, it can now report "notice"-level messages during the bundling step (packaging code to run remotely), in addition to the existing handling for outright bundling failures.

The error message shown when a push-on-release fails for a governed git mount was reworded. It now says "this runner-side push does not use the session's git-mount push URL," replacing older wording that described the governed mount as simply read-only. When a remote name is involved, the message now also explains that git skips every url.*.pushInsteadOf rule, including global and system-level ones, for this particular push, so the credential being used has to work on its own without relying on such a rule.

The status indicator added to the CLI header (showing Remote Control's connection state) now responds to the mouse: hovering highlights it, and clicking it fires a click telemetry event that records the status label shown at the time.

When Claude Code tries to fetch the current list of available models from the server and is refused specifically because the credential in use doesn't have permission to see it, a new handler now fires a model_catalog_primary telemetry event recording the decision as 'off' with the reason credential_scope, and prints a console note explaining that the built-in, compiled-in model list is being used instead.

The summary line shown at the top of an artifact's comments list can now leave out the "N open, " portion depending on a new condition, and the whole summary line now starts with a new leading piece of text.

When a hidden lookup used internally by navigate (tabs_context_mcp) times out waiting for a response, the resulting error message now also mentions that the machine running the Chrome extension's browser could be offline or asleep, in addition to the existing possibility that the extension itself was just slow to start.

When Claude Code blocks launching a subagent because a duplicate is already running, the instructions it shows no longer mention checking on progress with a dedicated tool. They now simply suggest sending the running subagent a message via SendMessage if you need a progress report.