Claude Code v2.1.275

When Claude Code runs a forked agent (a subagent branched off to do a separate task), it can now report token usage incrementally through a new onRequestUsage callback as responses stream in, in addition to the final total usage it already reported.

A large new module adds the ability to read back the published source of an Artifact (a piece of generated content Claude Code can publish, such as a document or app) through a new artifact_source_restore path. It reports detailed reasons when this fails, including permission checks, blocked outbound network access, organization mismatches, read timeouts, version lag, and warnings when another writer has changed the content.

Alongside this, new plumbing supports "Artifact Types": reading a type's catalog entry, its instruction file, and the content of individual files within it via artifact_type_link_read. This is tied to a feature state called frozenArtifactTypes.

Reminders — short system-generated notes inserted into the conversation, either attached to something the user typed or as their own standalone message — can now carry a media array of attachments alongside their text.

When a connection to an MCP server (Model Context Protocol, used to connect Claude Code to external tools and data) fails, the status output now includes an error_code field giving a specific reason, such as a rejected claude.ai login token, a rejected first-party Anthropic credential, or a connection that's pending approval.

Claude Code's permission logic for writing to artifacts (files or outputs Claude creates) has a new automatic-approval path. A write is now approved without asking the user when all of the following are true:

• it's a routine write
• the artifact is not public
• the caller already has write access
• the write wasn't invited by another organization

This applies even when the turn wasn't started by a human.

Claude Code ships a signed, static backup list of models to use if it can't fetch the live model catalog. In this release, the default model for two of the listed surfaces, 'ccr' and 'ccd', changed from claude-sonnet-4-6 to claude-opus-5. The 'cc' surface entry was already set to claude-opus-5 and is unchanged.

Artifact permission logic gains two new fields, invitedByOtherOrg and canWrite, computed by probing the artifact's role and mode. These feed directly into the write-consent decision, so Claude Code can now tell apart an artifact you own from one where someone in a different organization gave you editor access.

Artifacts (Claude Code's generated documents/apps) can copy assets from one artifact into another. This copy action now recognizes when the source artifact belongs to a different organization than the destination, and handles it explicitly:

• Copying from a public artifact outside your organization now shows a specific approval prompt before proceeding.
• Copying from an artifact shared directly from another organization shows a similar, separate approval prompt.
• If the destination artifact belongs to another organization, the copy is refused outright, with a message explaining that assets can only be copied into artifacts in your own organization.
• If the server doesn't yet support cross-organization copying, the tool now gets a distinct error telling it not to retry, instead of failing unclearly.
• Artifacts shared from another organization aren't yet listed automatically, so the user needs to supply the link directly.

This builds on the permission-rule checks already added for artifact copying: a new consent mechanism specifically for cross-organization copies now sits alongside it, so a human must approve before an outside-organization copy proceeds.

Claude Code now tracks, per tool use, whether the user has consented to reading artifacts belonging to another organization. When content from such an artifact (either shared directly from another organization, or a public artifact from outside the user's organization) is included, it's now given an explicit warning label instructing that it be treated as untrusted input.

Claude Code validates file paths against a set of allowed "anchor" locations, such as the current working directory, when checking where artifacts can be published or read from. Previously this logic assumed a single working directory plus a scratchpad. It now works from a general list that also includes any additional configured working directories, each labeled by kind (cwd, dir, or scratchpad). Error messages about disallowed paths now list all of the session's working directories instead of just one.

When a session is started with the --project-config-root flag, Claude Code now blocks two things:

• adding or removing project-scope MCP servers (connections to Model Context Protocol tool servers)
• creating durable scheduled tasks

Both now throw an error directing the user to use the local or user scope instead.

When Claude Code's sandbox checks whether a script invoked via a shebang line (the #!/usr/bin/... line that names an interpreter) is safe to run, it now uses a large table of argument grammars specific to each interpreter, including bash, dash, zsh, node, Rscript, osascript, fish, tclsh, wish, python, perl, ruby, awk, sed, php, csh, expect, and make. Previously this check was simpler and less permissive.

A set of new URL-parsing checks now looks for tricks that can hide or spoof the real destination of a git or ssh URL, such as a percent-encoded '@' (%40), a backslash, or IPv6-bracket formatting used to disguise the host. These checks feed into two things: redacting any embedded credentials before a URL is shown, and deciding whether a URL should be trusted.

When publishing an artifact that copies files from another artifact via a files map, Claude Code now checks whether the source artifact belongs to a different organization. If it does and that ownership can't be confirmed, the whole publish is rejected with a new error. Separately, publishing is now explicitly denied outright when the destination artifact itself belongs to a different organization.

Claude Code now checks environment variables and command-line flags for signs that something is trying to secretly redirect git operations or hijack the shell. This includes:

• Git environment variables like GIT_DIR and GIT_WORK_TREE, which can point git at a different repository or working folder than expected
• Shell variables like CDPATH, PATH, and IFS that can be abused to change how commands behave
• Git flags such as --git-dir, --separate-git-dir, --namespace, core.worktree, and includeif. that redirect where git reads its config or working tree, including shortened (abbreviated) forms of --separate-git-dir and --working-directory

This builds on earlier work (cloud file sync opening files through directory handles so a swapped symlink can't redirect a write) by extending the same kind of suspicion to git-specific environment variables and flags rather than just GIT_DIR and GIT_WORK_TREE.

When Claude Code is given a path as a local-directory or owner/repo argument and needs to check it (via stat), it now does more validation first:

• It outright rejects Windows device-namespace paths (those starting with \\?\ or \\.\), since these can't be safely checked for symlinks
• For other paths, it walks the chain of symlinks (the ancestry of links) to see if the path passes through a symlink pointing to a network location, or to a link target that can't be read

If either case is found, it refuses the path with a specific error instead of proceeding.

When a subagent (a secondary Claude instance handling part of a task) is launched from an in-process, tool-triggered call rather than a direct user action, Claude Code now checks the parent's permission mode. If the parent is in plan mode or dontAsk mode, forking a new agent is refused with a message explaining that the fork would otherwise run without the parent's restriction, and suggesting starting a fresh context instead.

A helper function used by the REPL (the interactive code-execution environment) sandbox no longer inspects input as JavaScript looking for require/import-style statements to block with a "sealed vm context" error. Instead, it treats the input as a file path: it expands $HOME or ~ prefixes, normalizes the path, and checks whether it falls under one of the configured workspace roots, returning true or false instead of throwing an error.

Running a command (command.run) or a skill (skill.prompt) now checks where the request came from. It only actually executes if it originates from the composer (the message input box) or a bridge message; otherwise it returns a placeholder message instead of running.

The check that runs before a plugin's command.run operation executes used to reject the call with an error if its arguments exceeded a maximum length. That rejection has been removed: the check now only records the argument length for telemetry (internal usage tracking) and always allows the call to proceed.

When you sign out of a gateway (a login/authentication server Claude Code connects through), Claude Code now tries to revoke both your session token and, if present, your identity provider's refresh token directly on the gateway. It finds the right endpoint to call by looking up the gateway's .well-known/oauth-authorization-server metadata. If that lookup or the revocation call fails, Claude Code logs the failure and falls back to simply ending the session on your local machine.

When a command is triggered from a link rather than typed directly, Claude Code now shows a confirmation prompt: "Run this command?", displays the command itself, and warns "Nothing runs until you answer. Only run commands from links you trust." The command only executes after the user answers yes or no.

The $.audio.play helper used to enforce two limits: a total number of plays allowed per session, and a limit on how many sounds could play at the same time. The per-session total-plays cap has been removed, along with its internal tracking. Only the concurrent-plays limit remains.

When Claude Code lists artifacts, it now also queries a second source of externally-shared artifacts (unless the listing scope is explicitly "mine") and merges those results in, marked as shared and external, with duplicates by slug removed. Whether the listing was truncated now also accounts for this second source running out of results.

Claude Code now blocks use of the 'Docs' artifact type unless the first-party Claude Docs connector is attached to the session. If it isn't attached, Claude is shown a message telling it to create a page instead of starting from that type.

When otelHeadersHelper (a user-supplied command that generates rotating OpenTelemetry headers) fails, Claude Code now records exactly why. Errors are classified into one of eight kinds: timeout, bad exit code, killed, failed to spawn, empty output, invalid JSON, output that isn't an object, or a non-string value inside it. Each failure is reported through a new event, tengu_otel_headers_helper_failed, that includes the failure kind and exit code, and is also broadcast so anything watching can react to it. The helper is now also fetched in the background ahead of time rather than only on demand.

A new function generates a detailed, role-specific explanation of an artifact's sharing state, whether it's private, shared within an organization, shared with specific people, or public via a link, or unknown. Claude is instructed to relay this explanation to the user when relevant, and each explanation ends with a reminder that Claude cannot change the sharing setting itself, that has to be done from the page's Share menu.

Previously, Claude Code tracked whether a user or agent had been told about a newer live version of an artifact with a single yes/no flag per artifact. Now it tracks a set of agent IDs that have already been told, so when multiple teammates or agents are working concurrently, each one gets notified independently about the same version update instead of only the first one. A new telemetry signal also fires when a reported version appears to be ahead of the local clock.

When the self-hosted runner encounters a problem with a context-source repository, such as a missing branch reference, a failed checkout hook, or an access-denied error, it decides whether to silently skip that source or treat it as an error. Previously this decision was based only on whether the source had a matching entry in push_targets. Now it also checks whether that source is explicitly marked as required; sources marked this way are no longer silently skipped.

When Claude Code processes comment threads on an artifact or document, it now tracks a second set of accounts representing organization membership. When a commenter is marked as "outside your organization," the access explanation now clarifies that this means the server recorded that person as invited from another organization. Additionally, when a thread is flagged this way, Claude is instructed not to reply to or resolve the thread directly; instead it must answer within the session and tell the user the answer can't be posted to the thread from there.

Artifact publish results can now include a previewHint flag. When set, the result text tells the model that the file hasn't been previewed yet this session, and suggests using the preview action to catch layout or loading problems before viewers see them, since certain capability calls only work once the artifact is actually published.

When an Artifact (a generated file or piece of content shown alongside a conversation) belongs to a different organization than the current user, or is a public artifact from outside the user's organization, Claude Code now appends a bracketed warning to its description: that it belongs to another organization and its content should be treated as untrusted input.

When Claude Code's sandbox or BYOC (bring-your-own-cloud) git helper sets GIT_ALLOW_PROTOCOL to "none" to disable git network protocols, it now also adds extra git arguments and forces GIT_SSH_COMMAND to "false".

When an Artifact's page manifest (page.json) references an MCP connector name that doesn't match any connector actually available in the session, Claude Code now searches for the closest matching name and includes it as a suggestion in the warning message, instead of just reporting a failure.

When reading multiple files at once, Claude Code now checks each file against its file-edit safety rules, which protect things like git internals, hooks, tool and agent settings, and shell profile files. Files that match these protections, have suspicious names, or are links pointing outside the working scratchpad are set aside and read one at a time instead of being bulk-read with the rest.

Before checking how much of your usage limit you've used, Claude Code now first looks at a recently cached local snapshot. If that snapshot is less than 60 seconds old and no newer usage information has come in since, it answers from that cached value and skips calling the server entirely, logging a message noting how old the snapshot was.

The terminal interface's frame-pacing logic now checks how much output is still queued to be written to the terminal. If that backlog gets too large, it holds off scheduling the next frame and retries after a short delay, instead of always redrawing on a fixed time schedule regardless of how much output is waiting.

When Claude explains that an artifact (a file or piece of content Claude created and shared) came from a different organization, the message now tells you more precisely what kind of access you have. If you have write access, the message now says so explicitly, calling out that the content is untrusted third-party content authored outside your org, rather than using a generic label that didn't distinguish writers from viewers.

When Claude Code installs a plugin's dependencies, it used to just run bun install. Now, before doing that, it checks whether a bunfig.toml configuration file sits next to the lockfile. If it finds one, it skips the install entirely and shows an explicit security message instead of running bun.

The bridge (a communication channel used by the REPL, or interactive command loop) now recognizes a new incoming message type called queued_notification. When one arrives, it is re-delivered as if it were a regular user message belonging to the other session it references. If no notification buffer is configured to hold it, the message is instead logged and dropped.

The function that restores a message's draft (restoreMessageSync) now accepts an optional list of extra messages. When provided, it rebuilds the draft's text and any pasted content from all of those messages combined with the target message, and concatenates their text together, instead of restoring only a single message's draft.

When updating an artifact in place using its url, the tool used to require that the artifact belong to the user. Now it also accepts an artifact the user was merely given edit access to, shown internally as the 'writer' role.

For plugins, the module field in hooks.json (the file that registers a plugin's hooks, which are scripts that run at specific points in Claude Code) must now point to a file with a recognized code file extension, and every file it imports from the plugin must too. Files with other extensions are rejected and simply not loaded, and a specific error message now lists which extensions are valid.

When Claude Code prepares styling instructions for building an artifact (a generated file such as a webpage), it now checks whether any of the system's files look like font files. If so, the instructions say fonts are already on disk and explicitly forbid fetching fonts from named web addresses. Otherwise, it keeps the previous instruction to obtain font files only through the Artifact tool.

When adding a plugin marketplace, a new helper now normalizes the source entry: if the source type is github, it normalizes the repository string; if the source type is git and the URL actually points to a GitHub repository, it rewrites the entry to use source: "github" with the shorthand repo name instead of keeping it as a raw git URL.

The /desktop command (which continues the current session in the Claude Code Desktop app) now shows clearer error text when something goes wrong:

• the too-old-version message is now shorter: "Claude Desktop ${version} is too old. Update to ${version} or later."
• the open-failure message now states the specific reason and what to do next: "Couldn't open Claude Desktop (${detail}). Open Claude Desktop and run /desktop again."

The TLS/certificate troubleshooting message now names the specific flag or environment variable relevant to each tool that might be involved in a certificate error: --cacert, SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, REQUESTS_CA_BUNDLE, AWS_CA_BUNDLE, DENO_CERT, CARGO_HTTP_CAINFO, PIP_CERT, GIT_SSL_CAINFO, BUNDLE_SSL_CA_CERT, HEX_CACERTS_PATH, and NIX_SSL_CERT_FILE.

When you're authenticated through 'gateway', the status or diagnostics view now also prints that gateway account's email address. This does not happen when running in demo mode.

Artifacts (generated files or outputs shared within Claude Code) now carry extra sharing metadata when shared in from outside your own organization: an external flag and a role on shared artifacts, a derived invitedByOtherOrg field, and an external_listed response flag. The interface now shows the text '(from another organization)' for artifacts shared this way.

When resolving an import path, Claude Code's module resolver now also tries a .mts file if the import ends in .mjs, and a .cts file if it ends in .cjs. This joins the existing mapping that tries .tsx for a .jsx import.

When an artifact's publish target is gone or ownership needs to be described, Claude Code now separately identifies two cases: an artifact that is public but belongs to a different organization than the user's, versus one that was specifically shared with the user from another organization. For the latter, a new explanation is added noting that access may have been withdrawn by its owner.

The copy_from action, used to copy assets between artifacts, now supports copying across organizations in some cases. It checks organization membership and probe state to determine whether a cross-organization copy is allowed (crossOrgOk), and blocks the copy with a specific error if the destination artifact is outside the user's organization and not allowed. If the first copy attempt fails because the destination isn't found yet and hasn't been probed, Claude Code now automatically retries once with a fresh probe.

When starting a new artifact of type 'document' without a first-party Claude Docs connector attached to the session, Claude Code now shows a dedicated explanation that a Docs artifact can only be filled in through that connector, and suggests making a plain page instead. The general list of available artifact types also now notes this caveat, and adjusts its "No published Artifact types" message to "No other published Artifact types" when the Docs connector is the reason.

When uploading files to the scratchpad (the attachment area for files you give Claude), fonts are now recognized as their own file category based on extension or content type. Fonts get their own byte-size and file-count limits (rejecting uploads with more than a set number of fonts), separate from the existing 8MB-per-file and total file-count caps that already applied to other files.

Uploads are also now checked for name collisions that differ only by letter case (after normalizing the filename); a file with the same name as an existing one except for capitalization is rejected.

The internal component that runs ripgrep (used to power search/grep) was rewritten. Output from the search process is now collected with a streaming buffer instead of simple string concatenation, there is a new error path for when writing to the process's input fails, and failures are now reported with distinct error types depending on the cause: file-not-found, an internal range error, or a generic spawn failure.

Claude Code's periodic cleanup process now scans each session's git-worktree cache folders for old images subfolders and removes any older than a cutoff age. This replaces older, more generic placeholder cleanup logic, and the results (what was removed, and any errors) now show up in the same summary as the existing history and session cleanup.

When Claude Code finishes a turn, it prints a short summary line of what happened (for example, how many files it read or shell commands it ran). That summary can now include a new 'script' category showing a 'working' indicator, alongside the existing bash, read, list, mcp (external tool connections), agent, and repl (interactive code execution) categories.

Claude Code can warn when a hook (a shell command that runs automatically at certain points, configured via plugins or settings) implicitly depends on the folder it's launched from, which can make it fail when run elsewhere. This detection was substantially expanded:

• it now strips hidden NUL bytes before decoding the script
• it recognizes more shells: ash, ksh, mksh, rbash, and fish
• it separates the shebang line (the #!/bin/... line that names the shell) from the rest of the script for more accurate analysis
• it adds a check specific to the csh shell for set path = (...) lines that contain relative or . (current directory) entries
• it detects relative file includes pulled in via make include or awk @include

Hooks can return extra context text (additionalContext) that gets added to what the model sees. When a single hook's context text is too large for its allotted space, Claude Code now writes the full text to disk and passes along a reference to that file plus a truncated preview, instead of simply cutting the text short and discarding the rest.

Claude Code now keeps track of prompts you've queued (typed and sent while a previous message was still being handled) that haven't actually reached the model yet. This tracking clears once the model starts responding to that prompt. A related addition tracks and can display the list of prompts queued up behind the one currently being processed.

The part of Claude Code that loads the list of artifacts (files or outputs generated and saved during a session) now fetches an additional set of results and merges in any artifacts that were shared with you but aren't already in your own list. These merged-in items are marked as shared and external, and carry a role field.

When logging out, if the current authentication method is an enterprise gateway, Claude Code now waits up to 5 seconds for any in-flight gateway calls to finish, invalidates the cached credentials, and looks up the stored gateway configuration to run a cleanup step on it before continuing with the rest of logout.

Queued notifications (messages waiting to be shown) now render with labels that identify their origin:

• notifications from a GitHub webhook are labeled 'github'
• notifications from a scheduled trigger are labeled 'scheduled trigger'
• notifications from another Claude session sending a message are labeled 'claude session'

Each notification shows a summary, body text, and an 'inbound:' badge. When there are more notifications than can be shown, a footer reads 'more N notifications still queued'.

When reading an artifact page or file returns a 404 (not found) error, Claude Code now checks whether the requested URL actually refers to a 'frozen artifact type' (an entry in a type catalog). If it does, it returns that type's declaration and instructions instead of just reporting the 404 as a failure. This applies to both the page read action and the single-file read_file action.

When Claude Code displays the result of a tool call that reads an artifact's type, it now checks a new type_file field in the result. If present, it shows either "read <path> of artifact type" or "did not read <path> of artifact type", depending on whether the file was actually read.

When a session controlled remotely transitions into a "running" state (meaning a new turn has started), the bridge now proactively tells the remote client that the post_turn_summary and recap (the end-of-turn summary data shown after a turn finishes) are null, and runs an additional cleanup step.

When the artifacts db_read or db_write tool encounters an error, the error message shown now includes additional detail such as the error code, reason, and slug, rather than just passing along the server's raw error text.

The result returned after publishing an Artifact now includes an iconDropped field, indicating when an icon or favicon was stripped out of the publish payload, similar to the existing deadlineDropped field.

When a subagent (a Claude Code task delegated to a separate agent) finishes, its tool results include a note about which files it's allowed to claim as its own work. This note now has different wording depending on the situation: if no save directories are configured at all, it says the subagent produced "no files during this run"; if saves are restricted but some files are still trustworthy, it now says the subagent may claim "only the files this note lists or counts."

When Claude Code reports how many files it read from outside the current folder, the message now checks a new elsewhereBeyondCwd flag. If a session has more than one working directory, the message says "the session's working directories" in the plural, instead of "the working directory" in the singular.

The description Claude sees for upload_asset, part of the Artifact tool, now distinguishes between uploading a single local file and uploading a list of several local files, phrased as "a list of N local files." This follows earlier work that expanded which file types (adding stylesheets and scripts) could be uploaded as assets.

When Claude Code restores file-history backups for a resumed session, it now keeps track of in-flight backup-copy operations, keyed by the backup file's name. If multiple messages reference the same backup file at once, they now share a single copy operation instead of each triggering a redundant copy.

When Claude reads the file that is the saved source of an artifact, the Read tool result now attaches a note like "This file is the saved source of artifact ... at version ...", stating that this version only counts as viewed once every line of it has been read.

The background-monitor tool's built-in description now explains that when a host application sets --project-config-root, that path becomes the effective working directory (the folder a command is considered to run in) for the session, instead of just saying the command runs in the session's working directory.

The helper that builds the "file not found" hint for artifacts was simplified. It now either returns a short "Did you mean X?" suggestion, based on filename similarity or a matching .html/.htm sibling file, or returns nothing at all. The previous, longer message text and the special-case suggestion to auto-author an HTML page from a markdown sibling file have been dropped.

The description for the sandbox status command was updated to say that it prints the Bash auto-allow setting, in addition to the enabled state, source, strict mode, and filesystem policy it already reported.

When a tool call is a "watch brief" (watchBrief === true) and its live subscription type is publish_context, Claude Code now shows a specific status message instead of a generic one: "Live subscription: none in this kind of session (see the earlier publish result); not an error."

If a permission request (a prompt asking you to approve a tool call) is still waiting and hasn't been picked up yet, and new input arrives while the session isn't shutting down, Claude Code now explicitly retires that pending request in the conversation transcript, and records how long it sat waiting before being retired.

A settings snapshot used for diagnostics and telemetry now reports whether the autoAllowBashIfSandboxed setting is enabled, along with where that value was set from: unsupported, policy, default, or settings.

The list of environment variables Claude Code considers safe to pass through (alongside existing ones like GNUMAKEFLAGS, MFLAGS, and MAKEFILES) now also includes AWKPATH, AWKLIBPATH, and DEVELOPER_DIR.

Claude Code checks environment variables for ones that could hijack a command by pointing it at attacker-controlled code or libraries. That check now also catches NLSPATH and DEVELOPER_DIR, in addition to the existing LD_, DYLD_, GCONV_PATH, and PYTHON-prefixed variables.

Claude Code's bash command safety analyzer, which explains why a command might be risky before it runs, now has a specific explanation for env -P: when given a relative directory, the program env runs is looked up starting from the directory you launched the command in, not from a fixed location. This joins existing explanations for commands that wrap other commands or run without a fixed shell, like parallel, script, su, and sudo.

The map used to detect a file's language from its extension now includes .cjs (mapped to JavaScript) and .mts and .cts (both mapped to TypeScript), alongside the existing .jsx, .js, and .mjs entries.

When Claude Code drains a queue of pending prompt messages to send them together, it now checks each one's "screening" status (a classifier check run when the prompt was submitted). If a queued message's screening is considered stale, the queue now stops accumulating further messages at that point, rather than always draining the entire run of same-mode messages as before.

When an agent is resumed in observer mode, Claude Code now passes an explicit agentToolScope pointing at that agent's own resolved definition, rather than following the path where it would inherit its parent's tool set.

A new function handles the case where a describe_type result includes a type file. It now distinguishes between a file that is unread or unreadable, showing a reason for that, and a file with normal readable content, before falling back to the previous formatting behavior for other cases.

When a conversation is forked (branched into a new session), Claude Code now also copies over any 'memory-mode' records from the original session into the new forked transcript, tagged with the new session's ID. This happens in both ways a fork can be created. It's in addition to the content and working-directory carryover that already happened during a fork.

The small tip shown next to the loading spinner used to be able to change while Claude was still working on a turn. Now, if a turn is in progress, a new tip is held back and only shown once that turn finishes.

When the AskUserQuestion tool can't show its usual permission prompt because it's running in a headless, asynchronous context, the denial message it returns now has two forms: one specific message for when the server side of the permission check was never requested, and the previous, more general fallback message for other cases.

When a tool that's part of the current conversation isn't actually available to use, the error message now distinguishes two different cases: the tool being switched off in the current session, versus the tool's source (such as a connected server) having been removed or disconnected. Each case now gets its own distinct message.

When Claude Code's file-history feature can't create a backup of a session's files by hard-linking (a fast way to duplicate a file without copying its data) and falls back to copying instead, it now writes to a temporary file first, checks that the copied file's size matches the original, and only then renames it into place. If the rename fails, it retries for about 1.5 seconds before giving up, logging a specific message if it's ultimately refused.

For browser_batch tool calls, which bundle multiple browser actions into one call, Claude Code now checks every URL in the batch up front rather than just the primary one. If any URL in the batch is a non-web or unparseable address (like a browser-internal page), the whole call is denied with a message telling the user to navigate to a web page first. If any URL matches a denied-domain rule, the call is denied and the specific offending URL is named.

Large tool results, hook outputs (output from custom scripts that run at certain points), and binary content are normally saved to disk when they're too big to keep in the conversation directly. When disk storage isn't available to save them, Claude Code now builds a truncated preview shown inline in the conversation, marked with an explicit <truncated-output> label and a message explaining that the output was too large, couldn't be saved, and only the first part is shown.

When Claude Code checks permission for reading a file from an artifact (via read_file/read_asset), it now detects if a file-edit safety check or an "ask" permission rule for one of the destination files changed while the permission check was in progress. If that happens, the read is denied with a message explaining that nothing was read and to retry, rather than proceeding based on stale information.

• The permission-request wording also now distinguishes saving multiple files at once ("save N files ... to ...") from the existing single-file wording.

The artifact watch tool (which monitors an artifact for changes) now returns a distinct error, watch_target_changed, when the action or url involved no longer matches the specific watch that was previously approved. The message tells the caller that nothing was carried out and to retry so the watch is checked again.