Claude Code v2.1.277

The directory-sync worker, which uses git to sync a local directory with a cloud session, gains a new attachOffer capability. When sync is listening but not yet actively syncing, it can now inspect the local repository's current branch and recent history and offer to attach to that existing history, provided the branch is resolvable, nothing is mid-operation, and consent checks pass.

Directory sync uploads your local files to the cloud side of a session using git. Claude Code now tracks whether the cloud side has actually picked up ('vouched for') what was uploaded, computing state such as when it was last confirmed and how long it's been settled. If the cloud session hasn't consumed anything synced from a directory yet, Claude Code now shows a warning that changes made locally and on the cloud side may not be reaching each other.

Claude Code now watches plugin skill directories (both whole folders and individual files) for changes, polling more often when there has been recent interaction and less often when idle. Before hot-reloading a plugin that uses 'files' scope, it asks a ConfigChange hook (a hook that runs when a configuration file changes during a session) whether the reload should proceed. If the hook blocks the reload, the currently loaded version of the plugin stays in place.

For sessions where a laptop's state is "attached" to a live machine, Claude Code now uses a lighter fast-forward or no-op check to keep directories in sync, instead of the older full three-way merge logic. This path can report that a session is "unready" (the machine has a detached HEAD) or "left" with a reason such as the branch being switched or having diverged. A companion function now also explains a new "switched off" case, meaning the sync feature is switched off for that session.

When Claude Code expands typed or pasted text, it now looks at all the text fragments together first. If the same content appears more than once, it avoids expanding overlapping duplicate spans a second time.

There's also a special case: if any of the matched fragments contains the word "ultraplan" (case-insensitive) and that exact text isn't already present verbatim elsewhere, the whole set of matches is suppressed and nothing gets expanded.

Claude Code now parses a shell command's structure (using a tree-sitter-based parser) to detect constructs considered unsafe to auto-approve without asking the user, including:

• brace and parameter expansions
• $'...'/$"..." style quoting
• command substitution ($(...)) and backticks
• process substitution (<(...) and >(...))
• arithmetic expansion ($[...])
• malformed or incomplete redirects

If any of these appear in a command, it's flagged as unsafe to auto-approve.

When Claude Code's file tool (used for Read, Bash, and similar operations) needs to pick which attached machine to run a command on, it can now fall back to a single remote machine even if that machine isn't set up for two-way or upload-only project sync. In that case, the tool warns that the remote machine holds its own separate copy of the project, that nothing is synced between it and the current session's checkout, and that it may be at a different commit.

When Claude Code changes its permission mode (the setting controlling what actions it can take without asking), it now first sends that change to the server and waits for confirmation. If the server doesn't accept the change within a time window, the permission-mode change is blocked and an explicit reason is shown, instead of the change silently taking effect anyway.

Claude Code's terminal text-wrapping logic (which decides how to break long lines of text to fit the terminal width) has been rewritten to properly account for ANSI escape and control sequences, the invisible codes terminals use for things like color and cursor movement. The new approach temporarily replaces these sequences with a placeholder character while wrapping, then verifies that the wrapped result still reconstructs the original text correctly. If that verification fails, it falls back to a simpler, character-based wrapping method and marks the result as "degraded." This replaces the previous text-measurement approach entirely.

When the rate-limit status returned is seeded, Claude Code now removes the limits field before building the rate-limit usage object it returns, so a seeded response no longer includes the detailed per-limit breakdown.

The code that builds a model picker entry for the "fable" model family used to return a rich object including a label and description text ("most capable for your hardest and longest-running tasks"). It now just returns the model's display name, or nothing if there isn't one.

Local debug log lines for tool input validation errors, validate-input rejections, permission denials, and runtime tool errors no longer include a raw slice of the offending input, message, or error text. Instead they report structured details: issue codes, byte/character counts, and error codes. These log lines also now use a new classifier that labels skill tools, MCP tools, and dynamically-named tools with a generic label like skill_tool, mcp_tool, or dynamic_tool instead of printing the tool's literal name.

The code-attribution report, which totals up how much of your code came from Claude versus a human, could get confused about which repository it was reporting on. It now separately resolves the repo root that was actually requested and the repo root the current session is really using, and only re-fetches ignored-file information for each root when they differ. Each file's Human/Claude split is now looked up using a key that includes which root it belongs to, with a fallback if the root doesn't match.

Installing a new version of a plugin now goes through a new subsystem that first compares the newly staged version's files against the currently installed copy, checking permissions, ownership, hardlinks, binary hook files, and node_modules, within a limited comparison budget. If the two are identical, the existing install is kept as-is. Otherwise, the old copy is atomically moved aside, the new version is published in its place, and the old copy is restored automatically if the swap fails partway through. On Windows, where directories can be temporarily locked, the swap retries with backoff, and it also guards against races when two installs happen at once.

When publishing an artifact, the file-upload and cross-artifact-copy steps now specifically detect a rate-limited response from the server and call a dedicated handler for it, instead of treating it as a generic 'upload unavailable' error. The final error message shown for a failed deploy now includes a retryAfter value read from the server's response headers.

When a plugin can't load because its marketplace source isn't known during this session (it's not in known_marketplaces.json, or it's listed under extraKnownMarketplaces but unusable), Claude Code now shows a specific diagnostic explaining why, and tells you to run claude plugin marketplace add <path-or-repo> to fix it. Previously this failed silently or with a generic marketplace-not-found error.

The directory-sync client used for uploading and downloading session files now signs each upload's content, path, and ifMatchSha256 value using a request-signer before sending it. If signing fails, Claude Code logs a warning once and records a telemetry event.

The confirmation prompt shown before publishing an Artifact was reworked to explicitly list the source artifacts, by title, when files are being copied server-side from more than one source. It also now marks file paths that live "in scratchpad" (a working/temporary area) in that confirmation message.

Claude Code keeps local "receipts" on disk to track whether a data store has been synced. Previously, clearing out a stale or empty receipt before a sync required a feature flag called tengu_typed_koala to be turned on, in addition to two other conditions. That flag check is now gone: the logic runs unconditionally, and the two other conditions (whether the on-disk receipt is empty, and whether a pull has already happened) have moved into the function that does the actual work.

A new internal function, boundRead, is used for file reads. It resolves a file's real path first, then opens it using flags that refuse to follow symlinks (O_NOFOLLOW on Linux, F_NOFOLLOW_ANY on macOS), and on Linux also double-checks /proc/self/fd to confirm the opened file matches the expected path. If a symlink (a file that points to another location) is found along the way, or the opened file doesn't match what was expected, the read is refused and a warning is shown.

When an agent acting as a 'coordinator' (an agent that manages other worker agents) tries to run a shell command, Claude Code now rejects commands that attempt to read a worker's transcript file or task output directory indirectly, including via:

• command substitution ($(...))
• a variable
• a ~name shorthand path
• a .. path segment
• an overly broad wildcard pattern

When a message coming through Slack looks like a slash command but didn't go through the existing bridge-slash-override handling and isn't confirmed to be from a verified human Slack user, a new check called resolveRelaySlashRefusal now runs and can block the message from being relayed.

When sandboxing and "auto-allow if sandboxed" are both enabled, Claude Code could previously let a Bash command run without asking for approval. Now that auto-allow also requires that the command does not match a new exclusion check, meaning some commands that would have been auto-allowed before will now still require approval.

When a session shows which machines are attached to it, Claude Code now handles a new case: the current session's checkout being the primary copy of the project, while a named machine holds the user's own separate copy with nothing synced between the two. This gets its own explanatory text, distinct from the existing case where a machine holds a synced mirror of the project.

The fixed message telling you "Projects is disabled by your organization's policy" has been replaced with dynamic wording driven by the allow_projects_tool policy check, so the text now matches whatever the actual policy decision says. Separately, if the policy check for allow_projects_tool was previously unresolved (a cache miss) and later resolves to allowed, Claude Code now automatically re-subscribes and rebuilds your project context instead of requiring a restart.

When Claude Code forwards requests through a proxy, it now applies explicit rules about which HTTP headers (the metadata sent alongside a request) are allowed through. Headers considered sensitive or connection-specific, such as authorization, x-api-key, host, and content-length, are stripped out. Headers whose names start with certain prefixes, including anthropic-, x-stainless-, x-claude-gateway-, x-goog-, x-amz-, and x-amzn-, are kept. New validity checks also confirm header names and values are well-formed.

Three compliance-gated capabilities change their behavior for when compliance status hasn't been cached yet (a cache miss):

• Projects tool access now defaults to holding (pausing pending confirmation) instead of allowing
• Team onboarding now defaults to holding instead of allowing
• Peer messaging now defaults to denying outright instead of allowing

When Claude Code syncs files, it now moves them through a dedicated staging folder that is locked down to the current user only (permission mode 0700, meaning only the owner can read, write or enter it). Before using this folder, Claude Code checks that it and its parent folder are genuinely owned by the current user with no group or other access. If the check fails, it deletes the folder and refuses to use it, reporting one of several specific reasons: it could not be created, it is not owned solely by the current user (which can happen on drives that don't preserve file permissions), or it turned out to be a symbolic link or another user's folder.

The existing cleanup routine that removes old staging folders has also been updated to skip the one that is currently in active use.

Messages relayed through the session inbox (used for things like Slack messages reaching a session) can now carry attachments. The message event builder accepts an optional attachments argument and includes it in the message data sent to the session. The attachments field has also been added to the list of fields treated as untrusted, alongside the existing body, sender_display, and slack_permalink fields.

The internal instructions that tell the model how to find and use artifact types now explicitly mention design systems, including ones built from your own codebase, as something the quickstart and list-types steps should handle. A new rule classifies design-system requests under an intent: "other" category, and a new instruction tells the model to look up and read an existing design-system artifact when answering questions about it, falling back to searching your files if no such artifact is listed.

When Claude Code extracts a plugin's files to disk to load it, it now records identifying details of that directory (its device, inode, and creation time) beforehand and checks them again afterward. If the directory was removed or replaced with something else during loading, Claude Code now throws an error saying the plugin directory "was removed before it could be loaded" or "was replaced while it was being loaded," instead of silently continuing.

If a plugin marketplace is referenced in your settings but hasn't yet been recorded in the internal known_marketplaces.json tracking file, Claude Code now checks it: it validates the declared source and path, and either admits it (letting plugins load from it right away, with a note that it will be formally recorded once a background reconcile step runs) or records why it was skipped, such as an invalid source type, an unanchored path, a manifest not found under .claude-plugin, or a rejection by the registry's admission rule.

When the internal task-reminder check runs, it now looks for whether the conversation has used the Brief tool. If it has, task reminders are skipped for that turn, at least by default.

When Claude Code's search tool (which uses ripgrep under the hood) fails to even start a search, it now explains why in more specific terms, rather than just reporting that the search failed. Recognized causes include the process or thread limit being reached, the system running out of memory, Claude Code itself having too many files open, or the whole system having too many files open. Each cause comes with targeted advice, for example telling the user that Claude Code needs a restart when the problem is too many files open by Claude Code (an "EMFILE" error).

When using the --tools flag to exclude a tool by name, if that name used to refer to a built-in tool that Claude Code has since removed, the CLI now shows a distinct message explaining that, instead of treating it as if you'd simply mistyped an unknown tool name.

Most response messages for /mcp enable, /mcp disable, and /mcp reconnect now choose between two wordings: the old "Run /mcp in the terminal..." text, or a new "Open MCP servers from the command menu." text.

When a large tool-output card is truncated and shown as "N more lines," the logic now scans for consecutive rows that share the same value and only cuts at the boundary between groups, rather than always truncating at a fixed row count as before.

When a cloud session hits a command check or hook that isn't defined in the user's own settings, and so can't be run automatically for that session, Claude Code shows a permission prompt asking for approval. That prompt's text has been rewritten to be shorter, and now tells the user how to make the check trusted going forward: by reviewing it and copying it into ~/.claude/settings.json.

When publishing an artifact, the files parameter no longer accepts entries shaped like {artifact, path} — a reference pointing into another artifact. Such entries now produce a validation error telling the caller to publish from a local copy instead, either a source path inside the artifact's root or an entry shaped like {from, contentType}.

When Claude Code asks for permission before copying, creating, or publishing an artifact, the confirmation message now shows the human-readable title of the source or destination artifact (or its type), falling back to "an untitled artifact" or "an artifact type" if no title exists. The raw URL is now shown on its own separate line instead of being woven into the sentence.

The Write tool, which creates or overwrites files, used to only check whether the target path was a symlink before writing. It now also checks for two more cases:

• the target path is a directory, in which case it reports that it's a directory and suggests including a file name in file_path to create a file inside it
• the target path is a non-regular file, such as a device, FIFO, or socket, which it now refuses to overwrite, noting that Write only creates or overwrites regular files

Each case gets its own distinct error rather than a generic failure.

When listing Artifact types (categories used for shared Artifacts), the type_query parameter used to work as a simple case-insensitive substring filter. It now ranks results by how well they match and drops weaker matches instead of just checking for a substring. Claude is now instructed to only use this parameter when a previous listing without it indicated more types exist than were shown.

When publishing an artifact fails, Claude Code now carries the reservedSlug (the reserved address for the artifact) forward in the failure result, so that a retry can reuse the same slug instead of getting a new one. This applies unless the artifact's slug is stranded, conflicting, or gone, and unless the artifact is a pr_review page.

A new error message was added for invalid-request authentication errors: "Login expired · Run /login to sign in again, or re-authenticate your Anthropic profile." This is shown under certain conditions as a separate message from the existing "Anthropic profile login expired" message.

Requests to the artifact database now retry automatically in a few situations:

• When the gateway reports it is busy, the request waits up to a capped delay and retries once, reporting whether the retry succeeded (relay_busy_recovered) or was needed at all (relay_busy_retried)
• When the server rejects "session hints" sent with the request, it retries once (session_hints_rejected)

Separately, failures where the relay is unavailable or not served are now recognized as distinct cases and surfaced with a dedicated error message instead of a generic failure.

When you run a slash command, Claude Code now first splits the raw argument text into pieces, checking whether any of them are a distinct "block" (such as a pasted chunk of content). If so, the text and body pieces are rejoined, separated by blank lines and trimmed, and that rejoined text replaces the original argument string before the command's permission checks and the rest of dispatch proceed.

When you paste a mix of content into Claude Code, text blocks that are short enough, under a certain character length and at most two lines, are now kept inline in your message text as-is. Previously, any such block would always be replaced with a placeholder reference to the pasted content. A line break is inserted after an inlined block if it's followed by another block or by more non-blank text.

When a tool call in the conversation is linked to a background task or process, its card in the interface now watches that background task's own status. Whether the card animates (shows as running) or displays an error now takes into account whether the linked background task is running, failed, or has been stopped, not just whether the tool call itself has resolved or errored.

When a command's tool output needs to be turned into a special, more specific error message (used in non-verbose mode), Claude Code now checks it against five distinct pattern-matching functions in sequence, up from three, before falling back to its generic write or delete failure messages.

Claude Code has new on-screen messages for when a tool call's result comes back after the conversation has already moved on. If a result shows up late, you'll see a placeholder line noting that an earlier tool's result has arrived. If the assistant paused to handle a new message from you while a tool was still running, a line now reports how long that tool took to finish.

Directory sync already refused to proceed when a repository's git configuration was unreadable or exceeded limits on include-chain depth or file count. It now also refuses when:

• the configuration defines more hooks and filter drivers than directory sync is able to switch off
• a config file is larger than 1 MiB
• a config file is a pipe or device rather than a regular file

When a plugin fails to install, Claude Code used to just print the plugin's name and a reason, cut off to 2 items. Now it tells apart internal errors from external ones, shows more of a long or multi-line external error (trimmed to a fixed length with "..." if needed), and adds a hint: pressing Enter on a plugin's details in /plugin shows its full error.

If you configure a custom anthropic provider (an LLM gateway) with custom HTTP headers in settings, Claude Code now checks that configuration more strictly:

• Header names must be valid HTTP header names
• The same header name can't appear twice, even with different capitalization
• Header names can't collide with reserved headers that the gateway or the provider's own SDK already sets or signs
• Header values must be non-empty, printable ASCII text with surrounding whitespace trimmed

Claude Code shows description text explaining what will happen when you publish or share an Artifact (a generated document or page). This text was rewritten from short, comma-joined fragments into standalone sentences, including clauses about sharing status. When an action would replace an existing page, the text now looks up and names that page, saying "replacing its current page" or "replacing the page ''" instead of just showing a URL.

When Claude asks to list artifact types and narrows the results with a type_query search term, the response now adds a note explaining that the list only shows types matching that search text, so a type the account actually has could be missing from what's shown. The note also explains how to list all types without narrowing.

When a tool call fails validation, Claude Code builds an error message describing what went wrong, such as missing, unexpected, or wrong-type parameters. That message now also includes any custom validation error messages produced by the validation library (Zod) when a check is specifically marked as "custom".

Debug and telemetry logging for the auto-mode classifier (the internal system that classifies actions Claude is about to take) no longer includes the actual text being classified. Previously the log for "new action being classified" could include up to 500 characters of the action's text; it now logs only the tool name, the length of the action text, and the tool-use ID. Similarly, when input to the classifier is malformed, the log used to include the actual error message text; it now logs only the character count of that error.

When file sync between a session and the user's attached machine stops, Claude Code now shows a rewritten message. It explicitly reassures that the local checkout is unchanged, remains the session's own copy, and that the user's remote folder is now a separate copy going forward. This replaces the older, terser wording that simply said the session began unbound.

The tool description text explaining that sharing an Artifact can also upload a custom thumbnail image changed from a trailing clause tacked onto another sentence ("with a custom thumbnail X") to its own standalone sentence ("Also uploads a custom thumbnail, X."). Path values used with this feature are also now escaped and normalized.

Several messages shown when a cloud session isn't picking up changes synced from a local folder have been reworded. They previously included a parenthetical explanation about 'its side of folder sync' being switched off; that explanation is now dropped in favor of plainer phrasing, such as stating that the cloud session never picked up anything synced from here and the session stops.

When a hook (a user-configured script that runs at a specific point, like before or after a tool call) fails, the error log now shows the hook's name and a rendered version of the error inline, instead of one generic combined message.

When Claude Code can't finish checking a project's commands on your computer, the message shown has changed. It previously read as a generic truncation notice, and now explicitly explains the situation as a permission request instead.

Claude Code maintains a list of hostnames used by cloud providers to serve instance metadata, which is blocked from being fetched as a security precaution. That list now also includes instance-data.ec2.internal, an Amazon EC2 metadata hostname.

Claude Code now has a dedicated error, KeyMintRefusedError, for when the server refuses to create an API key and doesn't give a readable reason. It shows the message: "The server did not create an API key and gave no readable reason. If this keeps happening, contact support."

The built-in claude-test plugin's read-only explorer subagent (a helper agent meant only to look around, not make changes) is now also barred from using the claude_test_app_up tool, which launches the app under test. This is in addition to the existing block on claude_test_allow.

Claude Code now re-asks the terminal for its cell size in pixels whenever the window regains focus, as long as something is still holding a fine-pointer reference, and also re-measures it after a paste. This keeps the cached cell-pixel dimensions from going stale.

When Claude Code starts up, it now checks each configured telemetry forwarding destination against the NO_PROXY environment variable. If the egress-boundary proxy mode is active and a destination's URL matches NO_PROXY, it logs a message noting that exports to that host will skip the proxy.

Messages that tell you where a file's content came from (of the form 'read from under X') now separate the location details with a colon instead of an em dash.