Patch release: richer artifact publish/list/update/watch flows, safer handling of invalid MCP tool schemas and destructive deletes, and clearer auto-mode denial accounting.
Changelog
[new] Artifacts support listing earlier publishes, updating an existing artifact by URL (so the link is kept), and session-local live watches (watch / status / unwatch) that notify on republishes from other sessions.
[new] Publishing an artifact can arm a live subscription automatically; watches reconnect if the connection drops or the short-lived credential expires, and appear in /tasks.
[changed] Before publishing, Claude must read the full file—even when asked not to—so content is never distributed unseen.
[new] MCP tools whose input schemas would be rejected by the API are dropped at load time; other tools from that server still load, and the exclusion reason is surfaced if you ask about a missing tool.
[changed] Transcript denial records distinguish real denials from aborts: interrupted / cancelled (Esc or turn-abort) are not counted as denials when aggregating permission history.
[changed] Irreversible-deletion protection now treats forced recursive deletes of /, ~, or a direct child of root as catastrophic unless the user named that exact target.
[changed] Questions with fewer than two options are rejected instead of shown; Claude states the single path and continues rather than inventing a filler choice.
[changed] Optional skill allowlisting for the main session matches canonical skill names (or a :name suffix) only—not display names or aliases.
[changed] Artifact tool results can include a liveSubscription field reflecting watch state after publish.
Models & prompts
Plan mode, focus mode, computer-use MCP, and PR/Slack follow-up guidance remain in effect, with focus mode still collapsing progress to the final user-visible message only.
Auto-mode classifier review and denial-analysis prompts were tightened so interrupt/cancel noise and MCP-authored error text cannot inflate denial counts or justify allow-rule proposals alone.
Skill-invocation wording was simplified; scoped directory skill selection and the hard “invoke skill before any other response” requirement were removed from the built-in skill guidance.
Under the hood
New frame deploy API routes (/api/frame/deploy/prepare, /api/frame/upload) back artifact upload/deploy preparation.
Internal gates for dropping invalid MCP tool schemas, OAuth 401 side-query recovery, auto-mode beta latching, background roster orphan pruning, org-memory decision lifecycle, and a simpler Fleetview path (CLAUDE_CODE_FLEETVIEW_SIMPLE / tengu_fleetview_simple).
SDK compatibility list extended through 0.3.215.
Stale experimental env flags cleaned up (policy skills, launch composer, ownership frame, workflow size warnings, and related one-offs).
Upgrade notes
Artifact watches do not survive restart or --resume; re-watch by URL if you still need live republish notifications.
If an MCP tool disappears after upgrade, check whether its input schema was invalid—the rest of that server’s tools should still be available.
content/
Browse captured content/
Same tree as claude-code/latest/content for this version. Open the full browser for sidebar navigation between docs and other files.
