Patch release: richer Artifacts actions (read, watch/status, multi-file), clearer agent behaviour around focus mode, corrections, and background work, plus internal bridge/sync and permission plumbing.
Changelog
[new] Artifacts gain a read action: fetch a published artifact by URL (raw content for your own; an isolated, optional-prompt-steered summary for ones shared with you).
[new] Artifacts support watch, unwatch, and status for live-update subscriptions when an artifact is republished or commented on (availability still depends on the session; when watching isn’t live here, the tool reports that plainly instead of implying notifications will arrive).
[new] Multi-file artifacts: list_files lists published paths for a URL; read_file saves one path into the scratchpad (or another out_dir after asking).
[changed] Artifact publish input is documented as an .html path (markdown publish wording dropped); conflict/force guidance now covers newer versions from other sessions and in-page saves, with merge-then-republish as the default path.
[changed] Deleting an artifact requires explicit user confirmation; sessions that can’t surface that prompt no longer retry deletes silently.
[changed] First publish / sensitive artifact actions in constrained sessions (e.g. Cowork without an approval surface) fail closed with a clear “don’t retry here” message instead of looping.
[changed] Sign-out or account switch drops prior artifact watches and comment auto-replies; a new publish/watch under the current account starts fresh—no silent re-watch just to resume listening.
[changed] Background-task membership is a level signal: hosts that re-initialize a still-running CLI get a snapshot of the current set immediately, so reconnects don’t leave a stale “work running” indicator.
[changed] Subagent guidance: background by default when useful work can continue; run_in_background: false only when the next step truly depends on the result; never invent pending-agent outcomes.
[changed]Focus mode: only the final text of each turn is shown—skip mid-turn progress chatter and put everything the user needs in that final message.
[changed]Corrections / memory: write durable memories in the same turn you engage a correction (including “want me to fix it?”), not after the conversation settles; follow-up questions alone are not treated as proof you were wrong.
[changed] Skill replay: embedded “## User Request” / “## Input” text from an earlier skill run is historical—don’t re-run one-shot setup or treat it as a live request.
[changed] Plan mode: reading someone else’s artifact still needs consent; if no one can answer that prompt in-session, keep planning in the plan file and raise the read in chat instead of retrying.
[changed] After opening/updating a PR, if CLAUDE.md mentions Slack, optionally offer a Slack post via ToolSearch—only when the user confirms; failures are skipped silently.
[changed] Computer-use MCP and Chrome flows: closed/missing tabs refresh via tabs_context_mcp; declining the Claude in Chrome extension suppresses repeat nudges for the session.
[changed] Rate-limit UX can surface a low-priority option when offered (accept/wait telemetry wired for that path).
[changed] Remote/CCR agents: permission decisions can be forwarded to the host session, with a documented fallback when forwarding isn’t available.
[removed] Legacy frame deploy complete/init API routes are gone from the client surface.
Models & prompts
Built-in agent copy tightens autonomy vs. interruption defaults, data-exfiltration caution (only post to chat/tickets when directed; secrets need explicit destination approval), and stash safety across worktrees/sessions (tagged stash push + apply by SHA, not bare stash/pop).
Context-management text states that long-thread summarization is normal—continue the task; don’t wrap up early solely because the window grew.
Classifier / auto-mode review prompts keep a strict fail-closed shape (response must begin with <block> where required); read-only exploration still bypasses that path.
Usage-insights “At a Glance” and teammate onboarding-guide helper prompts remain available with refreshed wording.
Under the hood
Directory-sync experiment knobs: archive, git layout, overlay, and optional anchor disable (CLAUDE_CODE_DIR_SYNC_*), with matching start/complete/failure events.
Bridge hardening: MCP carrier and prompt SHA256 env controls; bridge server config applied/rejected events; optional disable of hook and plugin forwarding.
MCP / tool process isolation hooks for memory cgroups (CLAUDE_CODE_MCP_MEMORY_CGROUP and related gates).
Windows Credential Manager integration path (tengu_windows_credman).
Bedrock content-type default can be turned off via CLAUDE_CODE_DISABLE_BEDROCK_CONTENT_TYPE_DEFAULT.
Chrome tab-group close telemetry; stray select-click drop handling; worker permission-mode restore on resume.
Internal feature-gate churn (cobalt/coral/ochre/slate-style gates and several OAuth lock / artifact hljs–mermaid gates retired or replaced)—no separate user-facing toggle list.
Upgrade notes
Prefer action: "read" (and multi-file list_files / read_file) over ad-hoc fetch flows when working with published artifacts; pass prompt when summarizing shared artifacts.
Don’t rely on bare git stash/pop in multi-session or worktree setups—use tagged stashes or WIP commits as guided above.
If you automate Artifacts over the SDK, expect new result shapes for read / watch / unwatch / status and treat watch as best-effort per session configuration.
content/
Browse captured content/
Same tree as claude-code/latest/content for this version. Open the full browser for sidebar navigation between docs and other files.
