Claude Code 2.1.265

• [new] The Projects tool supports project_memory_list and project_memory_read, so agents can list project memory files (path, size, updated time) and read their contents by path.
• [changed] Artifact access rules are tighter and more explicit: own first-party artifact files can be read without a separate approval; someone else’s artifact still needs consent; plan-mode foreign reads that cannot show a consent surface stay in the plan and are raised in chat instead of retried.
• [changed] Directory sync status is reported more clearly when uploads land but the sync service has not yet accepted (or has refused) the update record, including when the user’s machine will see a delay or will not receive the edits yet.
• [changed] Custom system-prompt replacement applies at the next render point (compaction) by default, or from the next turn when snapshotting is disabled; empty prompts are still rejected, and there is no revert-to-built-in form.
• [changed] Auto-mode permission flow: if the classifier transcript exceeds its context window, the tool call is treated as unreviewed and no permission prompt is raised (same limit until the conversation is shorter); saved allow rules and hook allows do not bypass the classifier.
• [changed] Focus mode guidance: only the final text of each response is shown to the user—skip mid-turn progress narration and put what they need in that final message.
• [changed] Subagent prompting: do not push synthesis onto the subagent with vague “based on your findings…” instructions; include concrete paths, line numbers, and the specific change. Subagents already receive the same CLAUDE.md injection (except built-ins that omit it, such as Explore and Plan).
• [changed] Desktop browser and computer-use tool discovery is clearer (Claude_Browser / claude-in-chrome tools when connected; remote computer-use tools need no separate enable step; don’t claim the computer is connected until a call succeeds).
• [changed] Correction/memory discipline: write durable memories in the same turn that engages a correction or diagnosis, not after the conversation settles.
• [removed] The plan-review step feature gate is gone.

Models & prompts

• Built-in behaviour text covers message-threads support (message-threads-2026-08-12 beta) and richer artifact/MCP edge cases (denied MCP, name clashes, unknown tools, still-connecting servers).
• Task-list “stickiness” guidance: don’t move done→working or failed→working unless the thread explicitly restarted.
• Autonomous/brief modes: if the only work left is waiting on a background task or monitor you started, end the turn and rely on the completion notification instead of polling.
• SendUserMessage / talking-to-user copy distinguishes normal vs proactive status and verbatim mid-task content vs routine narration.
• Connector helpers remain available for listing org MCP connectors and resolving registry directory UUIDs into full connector payloads.

Under the hood

• New opt-in / internal controls: CLAUDE_CODE_ARTIFACT_DB_STR_REPLACE, CLAUDE_CODE_ARTIFACT_FIVE_CLASS_ASKS, CLAUDE_CODE_DISABLE_AWAITING_USER_IDLE, and CLAUDE_CODE_TETHER_LIVE.
• Artifacts MCP backend route (/api/artifacts/mcp) and related gates for MCP list/switch/denied/unknown-tool and foreign-read flows.
• Early work on directory sync streaming, projects thread state/recap, tether live decision/audit, SDK MCP manifests and workspace trust, and partial stream-retraction display.
• MCP legacy SSE fallback gate; wake-subscription and cloud session gateway messaging when org policy blocks artifact comment watches.
• SDK compatibility matrix no longer lists wrapper 0.3.223 among tested versions (0.3.224+ remain).

Upgrade notes

• Callers using the Projects tool can adopt project_memory_list / project_memory_read; project_memory_read expects a memory path as returned by the list method.
• If you replace the system prompt programmatically, expect application at the next compaction/render unless you disable system-prompt snapshotting.
• Long auto-mode sessions can hit the classifier context limit and skip a permission prompt for that call until context is shorter—plan sessions accordingly.