claudekit / updates / claude-code-2-1-221
[ PATCH · ]

Claude Code 2.1.221

The VS Code extension gains Focus view, a chat-menu toggle that hides tool activity behind an expandable per-turn summary. Sandbox credential files on Linux and WSL support `mode: "mask"`, where sandboxed commands read a sentinel copy while the sandbox proxy substitutes the real value on egress. Two permission-check bypasses are fixed: zsh executing hidden commands in `[[ ]]` regex conditionals, and PowerShell checks mishandling paths with quote characters on Windows. Background sessions now commit and push to preserve work and open a draft PR only when the task calls for one, and plugins installed from `/plugin` activate immediately when safe instead of always requiring `/reload-plugins`.

Claude Code
Official announcement →

This article is a summary based on official documentation.

What changed

Claude Code 2.1.221 shipped on August 4, 2026. Two permission-check bypass fixes lead the release: hidden commands in zsh [[ ]] regex conditionals, and Windows paths containing quote characters, both of which could skip the permission prompt. Alongside them come Focus view in VS Code, a new way for sandboxes to handle credential files (mode: "mask"), and a smoother plugin install and activation path. Background sessions also change how they wrap up: they now commit and push their work and report where it lives.

New features

  • Focus view in VS Code

    The VS Code chat view expanded every tool call inline, which made an answer hard to follow. Focus view hides tool activity behind an expandable per-turn summary, with a live running-tool indicator on the summary line. Toggle it from the chat menu, with Ctrl+Alt+F, or via the “Claude Code: Toggle Focus view” command.

  • mode: "mask" for sandbox credential files

    Giving a sandboxed command access to a credential file meant exposing the real secret inside the sandbox. On Linux and WSL, mode: "mask" now lets sandboxed commands read a sentinel copy — the whole file, or just the spans captured by an extract regex — while the sandbox proxy substitutes the real value on egress. On macOS, file masking falls back to deny.

  • prompt-audit subcommand in the claude-api skill

    Prompts and tool descriptions written for older models can be unnecessary or counterproductive on current ones, with no easy way to spot them. The claude-api skill’s new prompt-audit subcommand audits prompts and tool descriptions for patterns written for older models.

  • Name warnings in claude plugin validate

    A marketplace or plugin name that Claude Desktop’s managed marketplace sync would reject only surfaced after publishing. claude plugin validate now warns about such names up front.

Key improvements

  • How background sessions wrap up

    It was hard to tell where a finished background session had left its work. Background sessions now commit and push to preserve work, open a draft PR only when the task calls for one, follow your CLAUDE.md git instructions, and always end by reporting where the work lives.

  • /plugin install retries after refreshing the catalog

    A stale marketplace catalog made /plugin install report a plugin as not found even when it existed. It now refreshes a stale catalog and retries before reporting a plugin not found.

  • Plugins from /plugin activate immediately

    Every install required a /reload-plugins before the plugin took effect. Plugins installed from /plugin now activate immediately when safe.

  • Plugins accept "." as a skills path

    There was no way to express a plugin whose SKILL.md sits at the root. Plugins now accept "." as a skills path, and the root-level SKILL.md validation error suggests using the plugin root.

  • Cache-efficient auto-mode permission checks

    Permission checks ran per parallel tool call without reusing the prompt cache. Checks for parallel tool calls are now cache-efficient, and prompt-cache costs drop further by reusing the cached conversation prefix across decisions. Switching modes while a check is pending now reliably prompts instead of applying the stale result.

  • Stats panel counts cache tokens

    The Stats panel’s token totals left out cache tokens, so they didn’t match actual usage. Cache tokens are now included, with a breakdown by input, output, cache read, and cache write.

  • Tool search on Google Vertex AI

    Tool search was unavailable on Vertex AI. It has been re-enabled for Claude 4.5-generation and newer models.

  • /status shows the session kind

    There was no way to check whether the current session was interactive or a background job. /status now shows the session kind: interactive, or a background job that is attached or unattached.

  • /fork sessions get their own worktree

    A forked session worked in the original session’s checkout, so both could touch the same files. Sessions forked with /fork now create a new worktree of their own.

  • /ultrareview error messages

    The messages shown when a repo shares no history with its base didn’t fit the situation. A checkout with no branches is now refused up front with advice to create one, and refusal hints no longer suggest git fetch --unshallow on clones that are already complete.

  • Windows startup no longer spawns PowerShell

    Reading process creation times spawned PowerShell, so endpoint security tools that gate powershell.exe prompted at every startup. Process creation times are now read via a native kernel32 call instead.

  • Fast mode reports credit exhaustion

    Running out of usage credits mid-session failed silently. Fast mode now reports on the stream when usage credits run out.

  • Monitor reports empty watches

    A watch that produced no output only said “stream ended”, which gave no clue why. Monitor now says that the watch exited without producing any output.

  • Gateway model field validation

    Non-string values in the Gateway model field were forwarded as-is. They are now rejected with a 400.

  • Emoji autocomplete accepts alternate shortcodes

    Common alternate spellings didn’t match in autocomplete. Emoji autocomplete now accepts shortcodes like :thumbsup:, :thumbsdown:, and :love:.

  • Claude in Chrome closes its own tabs

    Browser tabs opened by Claude in Chrome stayed open. It now closes the tabs it opens once it no longer needs them.

  • Repeated approval-prompt notice removed

    The “Permission mode changed while the auto-mode classifier call was queued” notice repeated on approval prompts. It has been removed.

Key bug fixes

Permission checks

  • A Bash tool permission-check bypass where zsh could execute hidden commands in [[ ]] regex conditionals — fixed; affected commands now prompt for permission.
  • PowerShell permission checks mishandling paths containing quote characters on Windows — fixed; such paths now prompt for approval.
  • Plugin- and org-delivered skills named after terminal-only built-ins (e.g. /help, /feedback) being un-invocable in non-interactive sessions — fixed.

MCP and headless runs

  • MCP servers from --mcp-config not being connected before the first turn in print mode (-p), which made the model emit tool calls as literal text — fixed.
  • A crash when preparing API requests for SDK MCP tools named after built-in object properties such as constructor — fixed.
  • Disabling an MCP server mid-connect silently reverting — fixed.
  • A rare wake-from-sleep race where two Claude Code processes could both refresh the same MCP connector or WIF OAuth token at once, forcing re-authentication — fixed.

Input and sessions

  • The thinking toggle having no effect for the rest of a session that started with thinking off — fixed.
  • @-mentioned files being silently dropped when pressing Esc to retract a prompt and resubmitting it — fixed.
  • Renaming a session from Claude Code Desktop or claude.ai not updating the CLI’s session name — fixed; session names from every rename surface are now sanitized.
  • CLAUDE_CODE_RESUME_INTERRUPTED_TURN=0 not disabling interrupted-turn auto-resume — fixed; falsy values are now honored.
  • The “Plugins changed” notification lingering after plugins were reloaded instead of clearing — fixed.
  • Vim mode: the yank register being silently emptied by dialogs, history search, and the transcript view — fixed; it now survives them.
  • Vim mode: undoing back to an empty prompt returning straight to the agent view — fixed; it now arms the “press ← again” confirm first.

Network and authentication

  • WebSearch failing with a 400 error at effort xhigh/max when thinking is disabled — fixed.
  • Sandboxed large uploads failing with TLS errors through the sandbox proxy — fixed.
  • The Team and Enterprise spend-limit message blaming the org’s monthly limit instead of your individual spend limit — fixed.
  • Bedrock authentication with AWS SSO named profiles failing in desktop-managed sessions on Windows machines that set a stray HOME environment variable — fixed.

Notes

  • This release includes permission-bypass fixes — hidden commands in zsh [[ ]] regex conditionals and Windows paths containing quote characters could both skip the permission check. Both now prompt.
  • mode: "mask" is Linux and WSL only — on macOS, file masking falls back to deny.
  • Focus view is opt-in — toggle it from the chat menu, with Ctrl+Alt+F, or via the “Claude Code: Toggle Focus view” command.
  • Background sessions commit and push on their own — they do so to preserve work, and they follow your CLAUDE.md git instructions, so put your policy there if you don’t want automatic commits.
  • /reload-plugins isn’t always needed — plugins installed from /plugin activate immediately when safe.
  • Tool search on Vertex AI is generation-gated — it works with Claude 4.5-generation and newer models.