Claude Code v2.1.227: A Comment-Thread Triage Agent, an Org Memory Endpoint, and Per-Spawn Bash Clamps#

Part of the Claude Code Version Tracker series. | Official Env Vars | Official Changelog

If you update from v2.1.224 to v2.1.227, you get a set of fixes.[1] Max plan members are no longer wrongly asked to turn on Fable usage credits when a session starts with an expired login token. Bash commands that failed under claude-code-action with allowed_non_write_users on GitHub-hosted runners now run. /tui no longer brings back a conversation that was rewound to before its first message. The slash-command menu now marks only the selected row in blue, makes matched letters bold instead of a different color, and keeps emoji and accented names.

The changelog lists only those items. The binary holds three more features that no note from v2.1.225 to v2.1.227 mentions. A bisect shows all three first appear in the v2.1.227 build, published August 10. None are in v2.1.226.

An agent that sorts artifact comments#

v2.1.221 let Claude Code publish a prototype as a live artifact and reply to comments on it. v2.1.227 adds a step before the reply. A built-in read-only subagent, comment-thread-analyst (up to 6 turns, limited to one artifact and its thread), reads a comment thread and returns a short JSON result. It returns edit when the thread asks for a change that a person must make. It returns pipeline when the thread is a question or a discussion that needs only a written answer. The prompt ends with "Output the JSON verdict only." Errors are logged as responder_triage_error, responder_triage_malformed, and responder_triage_threw. You turn dispatch on with CLAUDE_CODE_ARTIFACT_COMMENT_RESPONDER. If it is not set, the code uses the server gate tengu_bracken_sluice, which is off by default.

An org memory endpoint#

Two new env vars, CLAUDE_CODE_MEMORY_API_BASE_URL and CLAUDE_CODE_MEMORY_API_TOKEN, point Claude Code's memory-sync client at a server. That server is the Managed Agents Memory Stores REST API (/v1/memory_stores/…, public-beta header managed-agents-2026-04-01). If you set the token, the client sends Authorization: Bearer and does not refresh OAuth. The path is gated by tengu_haze_glass and an allow_memory_sync capability, and CLAUDE_CODE_DISABLE_ORG_MEMORY turns it off. A store is a set of small text files, scoped to a workspace, that stay across sessions. When you attach a store, it mounts at /mnt/memory/<store-name>/, and the agent reads and writes the files with the normal file tools.

The binary includes the full endpoint reference for this API: stores, memories addressed by path, immutable versions, content_sha256 preconditions, and version redaction. It is large, so it has its own post: Claude Code's Org Memory: the Memory Stores REST API lists every route, payload, and status code, plus the env vars to run it against your own server.

Per-spawn Bash command clamps#

A subagent can now carry a bashCommandClamp. This is a fixed set of command forms that limit what Bash the subagent may run. A command outside the set is refused with "this agent's Bash use is clamped to a fixed set of command forms (per-spawn bashCommandClamp)... Issue plain commands matching the clamped forms. Allowed forms:" and the list of allowed forms. The check is fail-closed: if the permission check crashes, the command is refused, not run. The same rule covers PowerShell. Refusals and crashes are tagged BASH_COMMAND_CLAMP_DENY_REASON and BASH_COMMAND_CLAMP_CRASH_REASON. The gate tengu_bash_command_clamp_denied records each refusal. bash_command_clamp sits in the session permission layer next to allowed_tools and disallowed_tools.

New Environment Variables#

VariableWhat It Does
CLAUDE_CODE_ARTIFACT_COMMENT_RESPONDERTurns on dispatch of the comment-thread responder. If it is not set, the code reads the server gate tengu_bracken_sluice (off by default), so the sorting agent stays idle. When it is on, the read-only comment-thread-analyst subagent sorts each thread into an edit request or a written reply.
CLAUDE_CODE_MEMORY_API_BASE_URLPoints the memory-sync client at a server instead of the default. This server is the Memory Stores API (/v1/memory_stores/…). Gated by tengu_haze_glass and allow_memory_sync, and turned off by CLAUDE_CODE_DISABLE_ORG_MEMORY. Full details in the Memory Stores API post.
CLAUDE_CODE_MEMORY_API_TOKENBearer token for that server. When set, requests carry Authorization: Bearer and skip OAuth refresh. The value is treated as a credential and hidden, like CLAUDE_CODE_OAUTH_TOKEN and ANTHROPIC_API_KEY.

What these tell us#

The announced changes in v2.1.227 are small fixes: a tier check that no longer fails on an expired token, a CI runner fix for claude-code-action, a /tui rewind fix, and clearer highlighting in the slash-command menu. They are useful, but they are not large changes.

The three unannounced features are bigger. The comment-thread analyst adds a sorting step to the artifact-comments loop, so Claude decides first whether a thread needs an edit or only an answer. The memory env vars let Claude Code use a memory server you choose, with its own bearer token, in front of a full REST API. The Bash clamp lets a parent agent limit a subagent's shell to a set list of command forms and refuse anything else. All three are already in the binary, one release before any note describes them.

This analysis is conducted for educational and research purposes under fair use principles. All trademarks and software referenced belong to their respective owners. This content is not intended to infringe on any intellectual property rights, circumvent any protections, or encourage unauthorized access to proprietary systems.

Sources#

  1. Claude Code Official Changelog, v2.1.227 release notes

Let's Connect

BlueskyLinkedInThreads
← Back to all posts