Source: raw/anthropic-watch-claude-code-tag-v2-1-221.md and raw/anthropic-watch-claude-code-tag-v2-1-222.md — official GitHub release notes captured by the Anthropic ecosystem watch on 2026-08-05. Continues Week 30; the reference tables in CLI Reference carry the new flags and settings.
Two releases — v2.1.221 (2026-08-04 00:14 UTC) and v2.1.222 (2026-08-04 22:39 UTC) — landing 22 hours apart after the longest release gap of the year. The headline is a worktree-isolation containment bug: isolated sessions and their subagents could run destructive git commands against the main checkout. Alongside it, a broad auto-mode safety batch, two Bash/PowerShell permission-check bypasses, and the removal of the ultraplan feature.
The release gap — there was no Week 31
v2.1.220 shipped 2026-07-25; v2.1.221 shipped 2026-08-04 — a ten-day gap with no releases in between, which is why this digest jumps from Week 30 to Week 32 with no Week 31 entry. The gap was visible to users: a r/ClaudeCode thread on 2026-08-04 noted “CC hadn’t been updated for about a week, then they dropped an update today with a lot of fixes” (raw/reddit-1vfgkee.md, score 59). The 39-change v2.1.221 changelog is consistent with a backlog flushing at once.
Key Takeaways
- Worktree isolation was leaky, and it is the most important fix here. v2.1.222: “Fixed worktree-isolated sessions and their subagents being able to run destructive git commands against the main checkout; isolation now applies to file edits and Bash in every session type.” Anyone relying on worktree isolation as a containment boundary for parallel or unattended agents was relying on a weaker guarantee than advertised.
- Auto mode gained a real safety gate on inter-agent messaging. Messages sent to other agent sessions via
SendMessageare now evaluated by the permission classifier before dispatch. Agent-to-agent messages were previously an unclassified path. - A hook-based permission bypass was closed.
PreToolUseauto-allow hooks were bypassing tool restrictions in background agent tasks (summaries, compaction, renames). - Two shell permission-check bypasses fixed (v2.1.221) — zsh could execute hidden commands inside
[[ ]]regex conditionals without prompting, and PowerShell mishandled paths containing quote characters on Windows. Both now prompt. ultraplanwas removed (v2.1.222). See the supersession note on Ultraplan.- Background sessions changed behaviour meaningfully: they now commit and push to preserve work, open a draft PR only when the task calls for one, follow your
CLAUDE.mdgit instructions, and always end by reporting where the work lives. /forknow creates its own worktree instead of working in the original session’s checkout — the same isolation theme.
Security and permissions
| Fix | Release |
|---|---|
| Worktree-isolated sessions + subagents could run destructive git against the main checkout | v2.1.222 |
PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasks | v2.1.222 |
SendMessage to other agent sessions now goes through the permission classifier | v2.1.222 |
zsh hidden-command execution inside [[ ]] regex conditionals | v2.1.221 |
| PowerShell permission checks mishandling quoted paths on Windows | v2.1.221 |
Remote Control auto-start can no longer be enabled by repo-local settings (only disabled); enable at user scope via /config | v2.1.222 |
New mode: "mask" for sandbox credential files (Linux/WSL) | v2.1.221 |
Credential masking is the one new capability in that list. Sandboxed commands read a sentinel copy — the whole file, or just the spans captured by an extract regex — while the sandbox proxy substitutes the real value on egress. On macOS, file masking falls back to deny; this is a Linux/WSL feature today.
The Remote Control change is a supply-chain hardening move worth noting on its own: a repository you clone can no longer turn Remote Control on through its checked-in .claude/settings.json.
New features and commands
- Focus view (VSCode) — a chat-menu toggle that hides tool activity behind an expandable per-turn summary with a live running-tool indicator.
Ctrl+Alt+For “Claude Code: Toggle Focus view”. prompt-auditsubcommand on theclaude-apiskill — audits prompts and tool descriptions for patterns written for older models. This is the tooling counterpart to The New Rules of Context Engineering: that article argues older-model habits (heavy rules, worked examples, repeated instructions) now hurt; this command finds them./statusshows session kind — interactive, or a background job that is attached or unattended.- Stats panel counts cache tokens, broken down by input, output, cache read, and cache write.
claude plugin validatewarns when a marketplace or plugin name would be rejected by Claude Desktop’s managed marketplace sync.
Plugins, skills, and MCP
- Plugins installed from
/pluginnow activate immediately when safe, instead of always requiring/reload-plugins. /plugin installrefreshes a stale marketplace catalog and retries before reporting a plugin not found.- Plugins accept
"."as a skills path; the root-levelSKILL.mdvalidation error now suggests using the plugin root. - Plugin- and org-delivered skills named after terminal-only built-ins (
/help,/feedback) were un-invocable in non-interactive sessions — fixed. - When Claude tries to invoke a skill marked
disable-model-invocation, it is now told to ask you to run the skill rather than replicating its workflow. /usagewas overattributing usage to MCP servers — a server’s share now reflects only requests that actually consumed its tool results, instead of every turn after any call to it. Anyone who has been sizing MCP cost from/usagehas been reading an inflated number.- MCP servers from
--mcp-configwere not connected before the first turn in print mode (-p), which made the model emit tool calls as literal text. - Fixed a crash preparing API requests for SDK MCP tools named after built-in object properties such as
constructor. - Tool errors are now displayed for tools no longer available locally (e.g. after an MCP server is removed).
Models, gateways, and enterprise
- Org-restricted
model: opussubagent and teammate family aliases were dropping to the parent model instead of stepping down to the newest org-allowed model in the family. - Stream idle timeout was firing on custom
ANTHROPIC_BASE_URLgateways despite server keep-alive pings arriving on the wire. - Gateway model-field validation now rejects non-string values with a 400 instead of forwarding them.
- Tool search re-enabled on Google Vertex AI for Claude 4.5-generation and newer models.
- Bedrock authentication with AWS SSO named profiles failed in desktop-managed sessions on Windows machines setting a stray
HOME. WebSearchfailed with a 400 at effort xhigh / max when thinking is disabled.- Team/Enterprise spend-limit messages incorrectly blamed the org’s monthly limit instead of your individual spend limit;
/usage-creditsblocked members whose earlier request had been dismissed.
Cost and performance
- Auto-mode permission checks got cheaper — prompt-cache costs reduced by reusing the cached conversation prefix across decisions, and permission checks for parallel tool calls are now cache-efficient.
- Windows startup reads process creation times via a native kernel32 call instead of spawning PowerShell, so endpoint security tools gating
powershell.exeno longer prompt. - Fast mode now reports on the stream when usage credits run out mid-session instead of failing silently.
Quality-of-life
/diff, the Remote Control workspace diff, and file-edit diffs on Claude Code on the web now use raw git blob content, ignoring workspace-configured diff drivers and textconv. Vim mode’s yank register survives dialogs, history search, and the transcript view. Claude in Chrome closes the tabs it opens. SendMessage truncates a long summary instead of failing on a character limit. Screen readers in --ax-screen-reader mode no longer re-read the whole input line on every backspace. Emoji autocomplete accepts :thumbsup:-style alternates. CLAUDE_CODE_RESUME_INTERRUPTED_TURN=0 is now honored.
Try It
- If you use worktree isolation to contain unattended or parallel agents, update to v2.1.222 — the isolation guarantee before this release did not cover destructive git against the main checkout.
- Run the new
prompt-auditsubcommand against yourCLAUDE.mdand skill files to find older-model patterns. - Re-check any MCP cost estimate you derived from
/usagebefore v2.1.222 — it was inflated. - On Linux or WSL, try sandbox credential
mode: "mask"in place of denying credential files outright.
Open Questions
- No official
whats-new/2026-w32digest page had been checked at ingest; this article is compiled from the GitHub release notes directly, as Week 30 was. - The worktree-isolation bug has no disclosed severity, CVE, or affected-version range. How long isolated sessions could reach the main checkout is not stated — worth knowing for anyone who ran unattended agents under isolation.
- Why was
ultraplanremoved? The changelog states the removal with no rationale or replacement. - The ten-day release gap is unexplained. It may be routine (holiday, release-train change) or may relate to the safety work shipped in v2.1.222.