docs: Claude Code v2.1.211 - live MCP connector artifacts, security fixes, prompt-caching regression fix

[claude-yolo]

Night shift report

WHY THIS MATTERS: v2.1.211 lands several things day shift should review: a meaningful new capability (artifacts that pull live data via MCP connectors at view time), two security hardening fixes (bidi-override injection in permission approval messages, and file upload path validation), and a billing regression fix affecting everyone on Bedrock/Vertex/Mantle/Foundry who had prompt caching enabled — that last one was silently overbilling users on every request.

HIGHLIGHTS:

• Artifact MCP connectors (new feature, docs updated): Published artifacts can now call MCP connectors when a viewer opens the page, enabling live dashboards. Each viewer's own account credentials are used for connector calls, not the publisher's. Connector-backed artifacts can't use public sharing links. Requires v2.1.209+, Pro/Max/Team/Enterprise plans only.
• Prompt-caching billing regression fixed: Bedrock, Vertex, Mantle, and Foundry were billing the trailing system context block as fresh input tokens on every request instead of hitting cache. Silent overbilling, now fixed.
• Security: bidi-override in permission previews (security fix): Tool input strings relayed to chat channels for approval could contain bidirectional-override, zero-width, or look-alike quote characters to visually misrepresent what was being approved. Now neutralized before display.
• Security: file upload path validation (security fix): DOS device suffix filenames (.prn etc.) and trailing-dot filenames are now accepted; files with multiple hard links are now refused. Claude in Chrome hardened separately.
• --forward-subagent-text flag (new feature): Opt-in flag (+ CLAUDE_CODE_FORWARD_SUBAGENT_TEXT env var) to include subagent text and thinking in stream-json output.
• PreToolUse hook ask now enforced in auto mode: A hook returning ask for an unsandboxed Bash call was previously overridden by auto mode; it now floors the decision at a prompt.
• "Always allow" rules now save at repo root: Approvals granted in one worktree now persist across all worktrees in the same repo.
• Agent SDK cost tracking clarified: New table in docs showing that usage excludes subagent tokens while total_cost_usd and modelUsage/model_usage include the whole tree. Use modelUsage for multi-agent token accounting.
• Data usage docs clarified: Error reporting (formerly called "Sentry") is now only active for Pro/Max direct-API users on v2.1.198+. Docs now clearly state the conditions under which it's on vs. off.
• Parallel session credential bug: Multiple Claude Code sessions sharing one credential store were all logging out simultaneously after wake-from-sleep. Fixed.
• Org connector tools respect bypassPermissions: MCP connector tools an org sets to ask now always fall through to the callback even in bypassPermissions mode — documented in permissions docs.

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning