Jonathon's AI Wiki

What's New in Claude Code — Week 32 (August 3–10, 2026)

19 min read

Source: raw/anthropic-watch-claude-code-tag-v2-1-221.md, -222, -223, and -224 — official GitHub release notes captured by the Anthropic ecosystem watch on 2026-08-05 and 2026-08-07. Continues Week 30; the reference tables in CLI Reference carry the new flags and settings.

Four releases across the week — v2.1.221 (2026-08-04 00:14 UTC), v2.1.222 (2026-08-04 22:39 UTC), v2.1.223 (2026-08-06 00:52 UTC) and v2.1.224 (2026-08-07 04:00 UTC) — a burst after the longest release gap of the year.

Two distinct stories sit in this week. The first half (221/222) is a containment story: a worktree-isolation bug let isolated sessions and their subagents run destructive git against the main checkout, alongside an auto-mode safety batch, two shell permission-check bypasses, and the removal of ultraplan. The second half (223/224) is an expansion story: Claude Code sessions can now message each other across machines, self-hosted runners let Team/Enterprise host web/mobile/desktop sessions on their own hardware, and the 200-subagent-per-session cap is gone — shipped alongside three more permission-check bypass fixes, one of which involved commands hiding themselves inside invisible Unicode.

The release gap — there was no Week 31

v2.1.220 shipped 2026-07-25; v2.1.221 shipped 2026-08-04 — a ten-day gap with no releases in between, which is why this digest jumps from Week 30 to Week 32 with no Week 31 entry. The gap was visible to users: a r/ClaudeCode thread on 2026-08-04 noted “CC hadn’t been updated for about a week, then they dropped an update today with a lot of fixes” (raw/reddit-1vfgkee.md, score 59). The 39-change v2.1.221 changelog is consistent with a backlog flushing at once.

Key Takeaways

  • Worktree isolation was leaky, and it is the most important fix here. v2.1.222: “Fixed worktree-isolated sessions and their subagents being able to run destructive git commands against the main checkout; isolation now applies to file edits and Bash in every session type.” Anyone relying on worktree isolation as a containment boundary for parallel or unattended agents was relying on a weaker guarantee than advertised.
  • Auto mode gained a real safety gate on inter-agent messaging. Messages sent to other agent sessions via SendMessage are now evaluated by the permission classifier before dispatch. Agent-to-agent messages were previously an unclassified path.
  • A hook-based permission bypass was closed. PreToolUse auto-allow hooks were bypassing tool restrictions in background agent tasks (summaries, compaction, renames).
  • Two shell permission-check bypasses fixed (v2.1.221) — zsh could execute hidden commands inside [[ ]] regex conditionals without prompting, and PowerShell mishandled paths containing quote characters on Windows. Both now prompt.
  • ultraplan was removed (v2.1.222). See the supersession note on Ultraplan.
  • Background sessions changed behaviour meaningfully: they now commit and push to preserve work, open a draft PR only when the task calls for one, follow your CLAUDE.md git instructions, and always end by reporting where the work lives.
  • /fork now creates its own worktree instead of working in the original session’s checkout — the same isolation theme.
  • Claude Code sessions can now message each other across machines (v2.1.224, macOS and Linux). Cross-session SendMessage plus ListAgents to discover them. This is a genuinely new surface: agent-to-agent messaging was previously within-machine. See the safety gating below — it is not an open channel.
  • Self-hosted runners (v2.1.224, Team and Enterprise). claude self-hosted-runner turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions execute. The hosted-vs-self-hosted axis that Managed Agents self-hosted sandboxes opened on the API side now exists for the CLI’s remote surfaces.
  • The 200-subagent-per-session spawn cap is removed (v2.1.224) — long-running sessions no longer refuse new agents. Concurrency and depth limits still apply. Relevant to anyone running long fan-out workflows that were silently hitting a ceiling.
  • A command could hide itself inside invisible Unicode (v2.1.223). Permission prompts now block commands padded with tabs or invisible Unicode from concealing part of themselves from the approval dialog — the approval UI was showing you less than what would run.

Security and permissions

FixRelease
Worktree-isolated sessions + subagents could run destructive git against the main checkoutv2.1.222
PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasksv2.1.222
SendMessage to other agent sessions now goes through the permission classifierv2.1.222
zsh hidden-command execution inside [[ ]] regex conditionalsv2.1.221
PowerShell permission checks mishandling quoted paths on Windowsv2.1.221
Remote Control auto-start can no longer be enabled by repo-local settings (only disabled); enable at user scope via /configv2.1.222
New mode: "mask" for sandbox credential files (Linux/WSL)v2.1.221
Bash permission bypass — a crafted command could hide parts of itself from permission checksv2.1.223
Permission prompts — commands padded with tabs or invisible Unicode could hide part of the command from the approval dialogv2.1.223
Workflow scripts could use dynamic import() to run code outside the workflow sandboxv2.1.223
An agent definition’s bypassPermissions mode ignored the org bypass-permissions disable policyv2.1.223
Sandbox filesystem deny entries written with a trailing slash (e.g. denyRead: "~/.aws/") were silently bypassable on Linux and macOSv2.1.224
Long (>200 char) project paths resolved to another project’s session directory under a shared sanitized prefixv2.1.224
SendMessage reported “Message sent” when the write to a teammate’s inbox had actually failedv2.1.224
Sandbox violation details never appeared in Bash tool results — Claude could not see which access was deniedv2.1.224

Four of these are the same class of bug: a control that looked stricter than it was. A deny rule with a trailing slash silently did nothing; an org policy disabling bypassPermissions was ignored by agent definitions; the workflow sandbox was escapable with import(); and the approval dialog could be shown a truncated version of the command it was approving. Anyone treating any of these as a hard boundary before this week was relying on a weaker guarantee than advertised — the same shape as the worktree-isolation bug that opened the week.

Two silent-failure fixes are worth separate note. SendMessage reporting success on a failed inbox write is exactly the fabricated-confirmation failure mode that agent workflows cannot detect on their own — a coordinating agent had no way to know its message was dropped. And sandbox violations never reaching Bash tool results meant Claude was debugging denials blind; it can now see which file or network access was refused and why.

Credential masking is the one new capability in that list. Sandboxed commands read a sentinel copy — the whole file, or just the spans captured by an extract regex — while the sandbox proxy substitutes the real value on egress. On macOS, file masking falls back to deny; this is a Linux/WSL feature today.

The Remote Control change is a supply-chain hardening move worth noting on its own: a repository you clone can no longer turn Remote Control on through its checked-in .claude/settings.json.

Cross-session messaging between machines (v2.1.224)

The single largest new capability this week. Claude Code sessions can now message each other on any of your machines, with ListAgents to discover them (macOS and Linux).

Two settings govern the inbound side, and the split is the important part:

  • crossSessionInbound — cross-session messages sent to a session running with bypassed permissions are held for your approval; messages to other sessions auto-deliver.
  • dialogExpiry — controls how long those held approval dialogs live.

The asymmetry is deliberate and worth reading carefully: the session that would be most dangerous to message remotely — one already running without permission prompts — is the one where an inbound message stops and waits for a human. This composes with the v2.1.222 change putting SendMessage through the permission classifier before dispatch. Together they mean agent-to-agent messaging crossed from a within-machine convenience to a network-shaped surface with its own gate on both ends.

Paired fix, same release: SendMessage previously reported “Message sent” when the write to the recipient’s inbox had failed. Failed deliveries are now reported as errors.

Self-hosted runners (v2.1.224, Team and Enterprise)

claude self-hosted-runner turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions can run. Previously those surfaces executed on Anthropic-managed infrastructure.

This is the CLI-side counterpart to the API-side option already covered in Managed Agents — self-hosted sandboxes and MCP tunnels: the same “run the sandbox on hardware you control” argument, now applied to the remote-access surfaces rather than to hosted agents. For regulated environments, this is the setting that makes Claude Code on the web viable at all.

Plugin distribution without git or npm (v2.1.224)

Archive plugin source: install plugins from a zip over HTTPS, with optional SHA-256 pinning. Neither git nor npm is required.

The SHA-256 pin is the load-bearing detail. A zip-over-HTTPS install with no pin is a trust-on-first-use supply-chain surface; with a pin it is a content-addressed one. Pair this with the v2.1.223 marketplace "owner/*" wildcards (below) when setting org policy — see Agent Skills on the general “don’t install, author instead” posture.

New features and commands

  • Focus view (VSCode) — a chat-menu toggle that hides tool activity behind an expandable per-turn summary with a live running-tool indicator. Ctrl+Alt+F or “Claude Code: Toggle Focus view”.
  • prompt-audit subcommand on the claude-api skill — audits prompts and tool descriptions for patterns written for older models. This is the tooling counterpart to The New Rules of Context Engineering: that article argues older-model habits (heavy rules, worked examples, repeated instructions) now hurt; this command finds them.
  • /status shows session kind — interactive, or a background job that is attached or unattended.
  • Stats panel counts cache tokens, broken down by input, output, cache read, and cache write.
  • claude plugin validate warns when a marketplace or plugin name would be rejected by Claude Desktop’s managed marketplace sync.
  • /review is now an alias of /code-review (v2.1.223), which reviews the current diff or a PR. /code-review ultra runs a deep cloud review. With no effort level, /code-review reuses the level you typed last — type /code-review high to change it.
  • /teleport hint in cloud sessions (v2.1.223) showing how to continue locally with claude --teleport.
  • Warning when a requested subagent model is restricted (v2.1.223) and the parent model runs instead — covers workflow agents, forked skills, slash commands, and resumed background agents. Previously a restricted model silently downgraded.

The feedback survey’s transcript share now also uploads the last request’s model settings with your consent: the system prompt — which includes your CLAUDE.md instructions — plus tool definitions and model parameters. Secrets are redacted as before, and these fields are dropped first if the share is too large.

If your CLAUDE.md carries anything you would not send to Anthropic (internal paths, client names, proprietary conventions), that is now in scope for a survey share that previously covered the conversation only. The consent prompt is the control point.

Related, same release: the Bash tool description was changed to always note that command output is displayed to the model, not reliably to the user — a small honesty fix to a long-standing mismatch between what the model assumes the human saw and what they actually saw.

Plugins, skills, and MCP

  • Plugins installed from /plugin now activate immediately when safe, instead of always requiring /reload-plugins.
  • /plugin install refreshes a stale marketplace catalog and retries before reporting a plugin not found.
  • Plugins accept "." as a skills path; the root-level SKILL.md validation error now suggests using the plugin root.
  • Plugin- and org-delivered skills named after terminal-only built-ins (/help, /feedback) were un-invocable in non-interactive sessions — fixed.
  • When Claude tries to invoke a skill marked disable-model-invocation, it is now told to ask you to run the skill rather than replicating its workflow.
  • /usage was overattributing usage to MCP servers — a server’s share now reflects only requests that actually consumed its tool results, instead of every turn after any call to it. Anyone who has been sizing MCP cost from /usage has been reading an inflated number.
  • MCP servers from --mcp-config were not connected before the first turn in print mode (-p), which made the model emit tool calls as literal text.
  • Fixed a crash preparing API requests for SDK MCP tools named after built-in object properties such as constructor.
  • Tool errors are now displayed for tools no longer available locally (e.g. after an MCP server is removed).
  • Marketplace "owner/*" wildcard entries (v2.1.223) in the strictKnownMarketplaces and blockedMarketplaces managed settings — allow or block all marketplace repos under a GitHub org in one entry, instead of enumerating repos.
  • MCP tools that connect mid-turn were being deferred for tool search without their names announced to the model (v2.1.224) — the model could not call a server that came up during the turn.
  • Plugin install records were being silently corrupted when the same plugin is installed in multiple projects (v2.1.224).

Models, gateways, and enterprise

  • Org-restricted model: opus subagent and teammate family aliases were dropping to the parent model instead of stepping down to the newest org-allowed model in the family.
  • Stream idle timeout was firing on custom ANTHROPIC_BASE_URL gateways despite server keep-alive pings arriving on the wire.
  • Gateway model-field validation now rejects non-string values with a 400 instead of forwarding them.
  • Tool search re-enabled on Google Vertex AI for Claude 4.5-generation and newer models.
  • Bedrock authentication with AWS SSO named profiles failed in desktop-managed sessions on Windows machines setting a stray HOME.
  • WebSearch failed with a 400 at effort xhigh / max when thinking is disabled.
  • Team/Enterprise spend-limit messages incorrectly blamed the org’s monthly limit instead of your individual spend limit; /usage-credits blocked members whose earlier request had been dismissed.
  • CLAUDE_CODE_DISABLE_1M_CONTEXT now holds every Claude model with a native 1M window to 200K via auto-compaction, rather than a fixed model list (v2.1.223). A startup warning appears when auto-compaction is not holding the session to 200K. If you set this env var expecting it to cover a newer 1M model, it previously may not have.
  • Auto-compact now keeps sessions on unrecognized model IDs within the assumed context window instead of letting them grow past it (v2.1.223). Restore the old behavior with CLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1.
  • Gateway model discovery was hiding Claude models registered under provider-prefixed IDs such as vertex_ai/claude-* or bedrock/anthropic.claude-* (v2.1.223).
  • modelOverrides keys that aren’t Anthropic model IDs were being treated as the session’s canonical model ID; unknown keys are now ignored as documented (v2.1.223).
  • ANTHROPIC_BEDROCK_REGION_PREFIX (v2.1.224) — prefer a specific cross-region inference profile over the one derived from AWS_REGION.
  • Managed settings: server-delivered settings no longer disable the env block of a machine-local managed-settings.json or MDM profile; admin env now merges per key (v2.1.223). The approval prompt no longer re-appears after re-login or org switching when org settings are unchanged (v2.1.224).

Cost and performance

  • Auto-mode permission checks got cheaper — prompt-cache costs reduced by reusing the cached conversation prefix across decisions, and permission checks for parallel tool calls are now cache-efficient.
  • Windows startup reads process creation times via a native kernel32 call instead of spawning PowerShell, so endpoint security tools gating powershell.exe no longer prompt.
  • Fast mode now reports on the stream when usage credits run out mid-session instead of failing silently.

Quality-of-life

/diff, the Remote Control workspace diff, and file-edit diffs on Claude Code on the web now use raw git blob content, ignoring workspace-configured diff drivers and textconv. Vim mode’s yank register survives dialogs, history search, and the transcript view. Claude in Chrome closes the tabs it opens. SendMessage truncates a long summary instead of failing on a character limit. Screen readers in --ax-screen-reader mode no longer re-read the whole input line on every backspace. Emoji autocomplete accepts :thumbsup:-style alternates. CLAUDE_CODE_RESUME_INTERRUPTED_TURN=0 is now honored.

Remote Control (v2.1.224)

A concentrated batch, mostly closing gaps where a client’s displayed state diverged from the real session:

  • A Remote Control session recreated after its server session expired was uploading prior local conversation history into the new session.
  • A session resume silently reconnected Remote Control after the user had turned it off (--resume, SDK hosts, VS Code extension).
  • Auto-start intermittently failed with “Remote credentials fetch failed” on a cold start with a stale login token.
  • Remote Control and SDK clients showed a blank “(no content)” message after /clear and other output-less commands.
  • Attached web and mobile clients now see compaction progress and the post-compaction boundary instead of a silent pause; /clear resets propagate to attached clients.
  • Connection failures now show a persistent failure indicator with details and a reconnect shortcut, instead of only an 8-second toast.
  • Stale server sessions are now archived rather than left listed as dead after compaction or /resume.
  • [VSCode] the extension showed Remote Control as connected after the connection had failed; sessions did not honor remoteControlAtStartup when explicitly enabled.

Also: fullscreen mode now keeps the full pre-compaction history in scrollback across repeated compactions, instead of only the most recent interval.

Try It

  1. If you use worktree isolation to contain unattended or parallel agents, update to v2.1.222 — the isolation guarantee before this release did not cover destructive git against the main checkout.
  2. Audit your sandbox deny rules for trailing slashes (v2.1.224). denyRead: "~/.aws/" was silently bypassable on Linux and macOS; denyRead: "~/.aws" was not. This is a one-character difference between a real boundary and no boundary.
  3. Run the new prompt-audit subcommand against your CLAUDE.md and skill files to find older-model patterns.
  4. Re-check any MCP cost estimate you derived from /usage before v2.1.222 — it was inflated.
  5. On Linux or WSL, try sandbox credential mode: "mask" in place of denying credential files outright. On v2.1.224 the masking options extend to extract / onExtractNoMatch for structured env values, decode: "jwt" with maskClaims for JWT-aware masking, and awsPairs / sigv4 for AWS SigV4 re-signing — all require network.tlsTerminate and are honored only from user, managed, or --settings settings.
  6. Before consenting to a feedback-survey transcript share, check what is in your CLAUDE.md — it now travels with the share as part of the system prompt.
  7. If you set org marketplace policy, replace per-repo entries with "owner/*" wildcards (v2.1.223).

Open Questions

  • The official whats-new/2026-w32 digest page is now live (fetched 2026-08-14, saved to ai-research/claude-code-docs-whats-new-w32-2026-08-14.md). The page confirms the same headline set this article covers (worktree isolation fix, cross-session messaging, self-hosted runners, ultraplan removal). No contradictions found; this Open Question is resolved.
  • The worktree-isolation bug has no disclosed severity, CVE, or affected-version range. How long isolated sessions could reach the main checkout is not stated — worth knowing for anyone who ran unattended agents under isolation. The same gap applies to the v2.1.223/224 permission-bypass fixes: no severity, CVE, or affected-version range is given for the invisible-Unicode padding bypass, the import() workflow-sandbox escape, or the trailing-slash deny-rule bypass.
  • Why was ultraplan removed? The changelog states the removal with no rationale or replacement.
  • The ten-day release gap is unexplained. It may be routine (holiday, release-train change) or may relate to the safety work shipped in v2.1.222.
  • Cross-session SendMessage is macOS and Linux only — no stated Windows timeline.
  • Self-hosted runners have no published pricing, sizing, or isolation model in the changelog line. Whether the runner inherits the same sandbox guarantees as Anthropic-hosted execution is unstated, and it matters most for exactly the regulated buyers the feature targets.
  • The 200-subagent cap removal names no replacement ceiling. “Concurrency and depth limits still apply” — but their values are not given.

Weekend and Monday follow-on — v2.1.225, v2.1.226, v2.1.227 (Aug 8–10)

Three more releases landed after the Aug 3–7 run. They are folded into this article rather than given a thin Week 33 stub, matching how the wiki skipped Week 31.

v2.1.225 (Aug 8) — the substantive one. Two additions and a long fix list:

  • Gateway spend limits surface in the usage warning. The limit-reached message now names the cap, its reset time, and the operator’s own message (requires the gateway on 2.1.225). This is the CLI-side counterpart to the budget controls in Managed Agents — the spend ceiling stops being an opaque cutoff and starts explaining itself.
  • Workspace trust prompt for claude agents in untrusted directories, matching claude’s existing behavior — closing a gap where the agents entrypoint skipped a security prompt the main entrypoint had.
  • Auto mode no longer counts a safety-filter refusal of its own permission check toward the consecutive-block limit. The action is still denied, but the model is told to move on instead of retrying — a self-inflicted-deadlock fix.
  • SendMessage can now start a conversation with Remote Control sessions on other machines by name (ListAgents shows them as name [ref]), rather than only replying after they message you first. This meaningfully extends the cross-session messaging shipped in v2.1.224 — from reply-only to initiating.
  • Headless/auth fixes: a transient 401 replacing a long-lived CLAUDE_CODE_OAUTH_TOKEN with a stored login’s short-lived token (broke headless sessions until restart); MCP OAuth servers on macOS failing in a burst of 401s after a keychain read timed out.
  • Other fixes: cross-session messages parked without notice or expiry; conversation history breaking on Remote Control resume after large compacted conversations; claude self-hosted-runner registering then failing every session when --base-dir can’t be created (now exits at startup with a clear error); web sessions misreported as stuck and re-sending a growing event backlog on reconnect; agents-list hover changing the next agent’s start directory.

v2.1.226 (Aug 8) — “bug fixes and reliability improvements,” no detail published.

v2.1.227 (Aug 10) — small but one entry is worth noting:

  • Fixed feature flags being evaluated without the user’s subscription tier when a session started with an expired login token, “which could wrongly prompt Max plan users to enable usage credits for Fable.” Max subscribers being asked to pay for something their plan covers is a billing-adjacent bug, and it is the second consecutive week with a billing-visibility fix.
  • Fixed every Bash command failing under claude-code-action with allowed_non_write_users on GitHub-hosted runners.
  • Fixed /tui restoring a conversation rewound to before its first message; slash-command menu polish; fewer event-loop stalls.

Graph View

Backlinks