7/7 Also: ultrareview now shows an estimated cost before launch and stops misreading free-text notes as a base branch; auto-mode permission-classifier calls can now be queued (behind a flag); and prompt history is flushed on exit so you stop losing typed prompts on quit.

6/7 Smaller but handy: SendFeedback now shows an inline card so you can approve a Claude-drafted bug/feature report with one click. Left-arrow now needs a second press to navigate away when the input is empty, fixing accidental navigation while editing. A new MCP client "v2" runtime is also staged behind a flag — no visible change yet.

5/7 More hardening: agent/skill hooks defined in frontmatter now only run if their source folder is trusted. Synced memory ("Org memory" is renamed to "Synced project memory" in /config) gets a mass-delete guard so a bunch of missing local files won't get wrongly treated as deletes.

4/7 Security hardening: forked background skill agents now have their permission scope persisted and re-checked on resume, even after a restart — they can no longer come back with broader permissions than they were granted. New spawn caps also stop runaway skill-invokes-skill chains.

3/7 Those clicks aren't just UI — they get saved back into the page and Claude can read them. A new Artifact tool action, read_page_data, fetches a published page and pulls out only the typed, validated decision data (never raw page content), so review threads can actually close the loop.

2/7 /artifact-pr-review turns a PR review into a shareable HTML page: summary, an open-concerns section, before/after diffs, flow diagrams, file-change stats, and a "Review on GitHub" button. Each concern gets decision pills (approve / request change / note, or free text) reviewers can click.

Claude Code 2.1.218 just landed on the next channel, and it's a big one: /artifact-pr-review lets you publish an interactive PR review page that collaborators can click through — and Claude can read their answers back. 🧵 1/7

6/6 Behind the curtain: a "workflow_launch" system lets Anthropic's servers dispatch signed workflow bundles straight into remote (Claude app-connected) CLI sessions — infra-only for now. Also in the works (flags off by default): local transcript compaction to shrink .jsonl files, and a usage-limit "grace window" that has Claude wrap up gracefully instead of cutting off mid-task.

5/6 Hardening batch: the updater can now self-heal a broken "claude" binary after a failed auto-update (restores from a preserved copy), worktree-isolated sessions block sketchy path spellings (UNC shares, symlink tricks), and repo-committed settings can no longer silently redirect your proxy/TLS traffic.

4/6 More control over subagents: - CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS and CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH env vars let you raise or lower parallelism and nesting depth. - --max-budget-usd is no longer just a tracker — once it's spent, new agents actually stop spawning instead of quietly overspending.

3/6 Two new things to run directly: - /explain-usage — plain-language breakdown of where your session's tokens went, with a simple chart. Nice complement to /usage and /cost. - /simplify — a built-in workflow that reviews your changed code for reuse, simplification and efficiency issues, then fixes them (fans out to parallel cleanup agents when available).

2/6 New: a full session-memory viewer. It lists every memory Claude recalled or read this session, and you can mark each one "good" or "bad and delete." First real way to see and curate what the memory feature is actually pulling in.

1/6 Claude Code 2.1.217 is out on the next channel 👀 Highlights: a Memory viewer where you can rate & delete what Claude recalled, a new /explain-usage command, a /simplify cleanup workflow, and configurable subagent limits. Plus big infra groundwork for server-dispatched workflows. Thread:

Plus a wave of security hardening: symlink/race-condition protection in Rewind and claude rm, SSRF-style blocking for the new artifact network calls, JWT-aware credential masking in sandboxes, and stricter Linux sandboxing (cap-drop ALL). 7/7

Also in this release: - A new cost report shows 7-day token usage and system-prompt overhead per skill, flagging ones that are loaded but never actually used - In-CLI spend limit & auto-reload management for your API credits (flag-gated rollout) - Resuming a session now falls back gracefully if the agent it used no longer exists, instead of failing 6/7

If you run agents isolated in git worktrees: Claude Code now statically checks every shell command an agent runs and refuses anything it can't prove stays inside that worktree — sneaky cd's, GIT_DIR env tricks, xargs-fed git commands, etc. all get blocked. 5/7

Auto mode is now Claude Code's default permission mode: it auto-runs the actions it assesses as lower-risk and blocks the rest, instead of prompting you for everything. You'll see a one-time notice explaining the switch. 4/7

New /artifacts command to browse everything you've published. Attach one to a session and Claude gets pinged when it's republished elsewhere ("live watch") — useful for iterating on the same artifact across sessions. This part is still behind a feature flag. 3/7

Artifacts can now be more than one HTML file. Publish a page plus its supporting CSS, JS, images, and binaries in a single call, so Claude can ship real multi-file sites instead of single-page snippets. It's rolling out server-side per account, so you may not see it yet. 2/7

Claude Code 2.1.216 (npm "next") is a big one: artifacts get a full publishing platform — multi-file pages plus a live-watch subscription system — and Auto mode is now the default permission mode. Thread on what's new 🧵 1/7