Patch release: safer shared-memory writes, document field str_replace with version checks, clearer shell-command descriptions, and removal of the artifacts MCP API path.
Changelog
[fix] Shared memory refuses to re-create a memory with the same content after it was recently deleted; if it is still needed, save it with changed content (not an identical copy at another path).
[new] Document writes support str_replace on a single string field (collection, doc_id, field, old_str, new_str, optional replace_all) so a unique snippet can be swapped without resending the whole value.
[changed] Document set / update / str_replace / delete (and each batch entry) accept if_version from the last read so a write is a no-op if the document changed underneath; stale-pin errors call out the first conflicting pin and ask for a re-read before resending.
[changed] Shell command descriptions must say what the command does in plain words — not echo the command text, flags, or file paths — because users often see the description without the raw command.
[changed] Publish label is documented as a short name for the publish itself (max 60 chars), not as a version-picker blurb.
[changed] If a publish did not land (for example because a hook or SDK host handled the path), the agent is told not to retry that call; publish the intended path in a new call or explain to the user.
[changed] SDK tool result typings allow optional seq and unchanged on applicable payloads.
[removed] The /api/artifacts/mcp backend route and the related artifacts-MCP feature gates are gone.
Focus mode: the user only sees the final text of each response — not tool calls, tool results, or interim narration — so progress belongs in that final message.
Subagent defaults stay background-first; run_in_background: false is only for when the next step truly cannot proceed without the result (with the usual limits when name/background or nested teammates are unavailable, and remote CCR isolation always background).
Correction memories must be written in the same turn the correction is engaged (diagnosis, fix, or “want me to patch it?”), not deferred until later.
When Chrome browser tools are deferred, load everything needed in one ToolSearch batch rather than one tool per round-trip; refresh tab context after closes or navigation errors.
Org MCP connector helpers: list installed connectors (optional keyword filter) and resolve full connector payloads from SearchMcpRegistrydirectoryUuid values — no guessing UUIDs.
SendUserMessage guidance tightened for what users actually read (including attachments as paths or device-uploaded file objects, and normal vs proactive status).
After a GitHub push, the agent can offer connecting the repo to claude.ai so work can continue when this machine is offline.
Autonomous / brief modes: prefer action, avoid polling background work you will be notified about, and keep brevity when the user asked for it.
Workflow-script sessions: final text is the return value to the caller — literal result only, no “Done.” padding.
Permission-denied tool outcomes still state clearly that the rejected action (for example a file edit) was not applied.
Git auth on runners: bot/agent sessions do not manage git auth on the runner (supersedes --git-host-rewrite).
Refusal / pushback tone: if the user reaffirms after a concern, proceed when appropriate; reserve hard refusals for genuinely harmful or prohibited requests, and keep confirmation on risky or destructive actions.
Under the hood
New environment knobs for artifact hot path, desktop app version, model capabilities, remote-tools MCP adoption, and SendMessage handback (CLAUDE_CODE_ARTIFACT_HOT, CLAUDE_CODE_DESKTOP_APP_VERSION, CLAUDE_CODE_MODEL_CAPABILITIES, CLAUDE_CODE_REMOTE_TOOLS_ADOPT_MCP, CLAUDE_CODE_SENDMESSAGE_HANDBACK).
Experimental gates landed for nonblocking stdout, stable session addressing, remote passthrough, plan classification, web setup push offer, CCR upload hold marking, compact-replaced-by-hook, worker-owner killswitch, and related internal experiments; older cobalt-plinth and umber-lattice gates were dropped with the artifacts MCP cleanup.
Scratchpad remains session-specific and isolated from the project so it can generally be used without permission prompts.
AWS client error text when @aws-sdk/credential-providers is missing still points at supplying a custom providerChainResolver.
Upgrade notes
Anything still calling /api/artifacts/mcp or depending on the old artifacts MCP switch/list behavior needs another integration path — that route is removed.
SDK wrapper 0.3.224 is no longer on the tested compat list; use 0.3.225 or newer.
content/
Browse captured content/
Same tree as claude-code/latest/content for this version. Open the full browser for sidebar navigation between docs and other files.
