Patch release with richer artifact tooling, clearer AskUserQuestion follow-ups, focus-mode and browser-tool guidance, and tighter cloud/remote session behaviour.
Changelog
[new] Artifacts support a list_types action so sessions can discover available artifact kinds before creating or reading them.
[new] Artifact file payloads can carry an optional cowritten marker for content produced jointly with the user.
[changed] AskUserQuestion flow: do not invent filler “Other”/“Skip” choices; open-ended answers stay free-form; if a choice question has fewer than two options it is rejected and should be re-asked as text or stated as the chosen path.
[changed] When the question result says so, ask again with follow-up questions that build on the answers before starting the task — do not repeat the prior set or proceed early.
[changed] Focus mode: the user only sees the final text in each response (not tool calls, results, or mid-turn narration). Put everything they need in that final message.
[changed] Claude in Chrome / desktop browser tools: if connected, tools are already present (names containing claude-in-chrome / Claude_in_Chrome, or else Claude_Browser); no separate enable step. If neither set is available, say the browser is not connected and continue with local work.
[changed] Chrome browser tools that load via ToolSearch should be batched in one select call (comma-separated), not loaded one-by-one.
[changed] Whiteboard artifacts: create a live sketch canvas (wireframe diagrams, sticky notes, freehand, multi-user cursors). Existing boards are read via the published artifact; creation is for new boards only.
[changed] Artifact access: list/read the user’s own artifacts without extra approval; for anyone else’s, ask once per artifact. Copying assets into a published artifact needs an explicit consent surface in chat when no one can answer an in-session prompt.
[changed] Remote / cloud sessions: git, SSH keys, commit-signing keys, credential helpers, and gh login are not present in the sandbox — when push/fetch/signed commit/gh fails for lack of credentials, run that command on the user’s machine instead.
[changed]claude --cloud config handoff sends CLAUDE.md, rules, output styles, preferences, and non-path permission rules from the folder; skips credentials, hooks, env vars, MCP servers, plugins, and anything Read rules or sandbox settings deny; each launch reports what was sent (encrypted at rest).
[changed] Directory sync can report when this turn’s versions of files were not pushed to the user’s machine (concurrent writes, or checkout state the sync will not read).
[changed] Subagents default to background with a completion notification; use foreground only when the next action truly depends on the result. Never fabricate pending agent output.
[changed] Corrections memory: write durable memories in the same turn that engages the correction (diagnosis, fix, or offered next step) — do not wait for a later confirmation.
[changed] Workflow-script runs: the final text response is the script’s return value; emit the literal result, not a human-facing “Done.”
[changed] Setup writing-style skill: if the user opts in, run setup-writing-style end-to-end via the Skill tool without narrating over it; the step finishes only on save success, user confirm, or skip/move-on.
[changed] Agent prompts stress proving understanding in delegated work (paths, line numbers, concrete changes) rather than “based on your findings…” handoffs.
[changed] Managed / org surfaces refine connector listing and resolution, per-tool toolPolicy locks, marketplace archive HTTPS rules and credential kinds, and optional inference model pricing overrides for usage estimates.
[removed] Dropped older SDK wrapper 0.3.218 from the tested compatibility list (still covers 0.3.219+).
Models & prompts
No new public model IDs or default model switches in this release.
Built-in behaviour updates cover focus mode, questioning/follow-ups, browser tool discovery, artifact and whiteboard creation, cloud config scoping, remote git/credential limits, subagent backgrounding, correction memories, and workflow-script return values (see above).
Safety/classifier copy still errs on blocking for auto-mode review stages, with stage-1 rules not applying user-intent ALLOW exceptions (those stay for later stages).
Guidance on refusals vs ordinary sensitive-sounding work, data-exfiltration caution for chat/tickets, and “plausible by default” review posture is retained and tightened in places.
Under the hood
New internal controls and env options for experiments and ops (including host profiling, Chrome MCP org denial, MCP serve auth token, user-intent forwarding, extended questioning, and related feature gates).
Prompt-cache ledger API path added; legacy directory API path removed.
AWS Cognito Identity FIPS regional endpoints removed from the bundled endpoint set.
Assorted internal gates for artifact recovery/withholding, directory-sync upload rules, structured-output schema lint/enforcement, teleport/bundle read rules, and CCR upload trimming.
Binary size down slightly across platforms; build e51f681 (2026-09-03).
Upgrade notes
If you rely on choice questions in AskUserQuestion, ensure at least two real options or use open text — single-option choice prompts are rejected.
In focus mode, expect only the final assistant message in the main view; plan user-visible status for that message.
Cloud launches (claude --cloud) now also respect sandbox/Read denials when packaging folder config; review what each launch reports as sent.
Remote CCR/sandbox git and gh still need credentials on the user’s machine when the sandbox has none.
SDK consumers: optional cowritten on relevant artifact file shapes and list_types on the artifact action union; re-check typed wrapper support if you pinned 0.3.218.
content/
Browse captured content/
Same tree as claude-code/latest/content for this version. Open the full browser for sidebar navigation between docs and other files.
