claudekit / updates / claude-code-2-1-224
[ PATCH · ]

Claude Code 2.1.224

Self-hosted environments arrive: claude self-hosted-runner turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions can run, on Team and Enterprise plans. Cross-session SendMessage lets Claude Code sessions message each other across your machines, with ListAgents to discover them (macOS and Linux), and a new archive plugin source installs plugins from a zip over HTTPS without git or npm, with optional SHA-256 pinning. Sandbox credential masking gains extract, onExtractNoMatch for structured env values, JWT-aware masking, and AWS SigV4 re-signing. Long project paths no longer resolve to another project's session directory, sandbox deny entries written with a trailing slash are no longer bypassable, sandbox violation details now reach Bash tool results, and the 200-subagent-per-session spawn cap is gone.

Claude Code
Official announcement →

This article is a summary based on official documentation.

What changed

Claude Code 2.1.224 shipped on August 7, 2026. The release widens where sessions run and how they reach each other: claude self-hosted-runner turns your own machines or containers into a place cloud sessions can run, cross-session SendMessage lets separate Claude Code sessions message one another, and a new archive plugin source installs plugins from a zip without git or npm. Alongside those, sandbox credential masking gains structured and JWT-aware options, and fixes land for session directories colliding across projects and for sandbox deny entries that could be bypassed.

New features

  • claude self-hosted-runner — self-hosted environments

    Claude Code web, mobile, and desktop sessions only ran in Anthropic-provided environments, which didn’t fit work against repos or internal services reachable only from inside your own network. claude self-hosted-runner now turns your own machines or containers into a place those web, mobile, and desktop sessions can run. Available on Team and Enterprise plans.

  • Cross-session SendMessage and ListAgents

    SendMessage only reached subagents spawned inside the same session, with no way to reach a separate Claude Code session running elsewhere. Claude Code sessions can now message each other, on any of your machines, with ListAgents to discover them. Available on macOS and Linux.

  • crossSessionInbound and dialogExpiry settings

    A cross-session message arriving at a session running with bypassed permissions could be acted on without you seeing it. Cross-session messages sent to a session running with bypassed permissions are now held for your approval, and messages to other sessions auto-deliver; the crossSessionInbound and dialogExpiry settings control this.

  • archive plugin source

    Installing a plugin required a git repo or an npm package. The new archive source installs plugins from a zip over HTTPS without git or npm, with optional SHA-256 pinning so you can verify the download is the file you expected.

  • Sandbox credential-masking options

    Sandbox credential masking covered whole env values, which didn’t fit values that carry other data alongside the secret or structured tokens like JWTs. New options: extract and onExtractNoMatch for structured env values, decode: "jwt" with maskClaims for JWT-aware masking, and awsPairs/sigv4 for AWS SigV4 re-signing. These need network.tlsTerminate and are honored only from user, managed, or --settings settings.

  • ANTHROPIC_BEDROCK_REGION_PREFIX for Bedrock

    On Bedrock, the cross-region inference profile was derived from AWS_REGION with no way to point at a different one. The new ANTHROPIC_BEDROCK_REGION_PREFIX env var makes Bedrock prefer a specific cross-region inference profile over the AWS_REGION-derived one.

Key improvements

  • The 200-subagent-per-session spawn cap is removed

    A session could spawn at most 200 subagents, so long-running sessions eventually refused new agents. That cap is gone; concurrency and depth limits still apply.

  • Fullscreen mode keeps full pre-compaction history

    In fullscreen mode, repeated compactions left only the most recent interval in scrollback. Fullscreen mode now keeps the full pre-compaction history in scrollback across repeated compactions.

  • Remote Control shows compaction progress

    Attached web and mobile clients saw a silent pause while the conversation compacted. They now see compaction progress and the post-compaction boundary, and /clear resets propagate to attached clients.

  • Remote Control connection failures persist on screen

    A failed connection surfaced only as an 8-second toast, easy to miss. Connection failures now show a persistent failure indicator with details and a reconnect shortcut.

  • Remote Control archives stale server sessions

    When a fresh session was minted after compaction or /resume, the old server session stayed listed but dead. Remote Control now archives the stale server session instead.

  • Managed settings approval prompt stops re-appearing

    The managed-settings approval prompt came back after every re-login or org switch. It no longer re-appears when the organization’s settings are unchanged.

  • Feedback-survey transcript share now includes model settings

    A shared transcript carried the conversation only, leaving out the settings needed to reproduce a problem. With your consent it now also uploads the last request’s model settings — the system prompt (which includes your CLAUDE.md instructions), tool definitions, and model parameters. Secrets are redacted as before, and these fields are dropped first if the share is too large.

  • Bash tool description

    Command output goes to the model and isn’t reliably shown to the user, but the tool description didn’t always say so. The Bash tool description now always notes that command output is displayed to the model, not reliably to the user.

  • Handling of unavailable pastes

    Recalling an earlier input whose paste had aged out could quietly change the command’s text before it ran. There is now a cancel-and-confirm step when removing an unavailable paste changes a command’s text, and recalled paste placeholder numbers renumber when accepted into the input.

Bug fixes

Sessions & projects

  • Long (>200 char) project paths resolving to another project’s session directory under a shared sanitized prefix — fixed; session list, rename, fork, delete and /resume no longer cross projects.
  • Plugin install records being silently corrupted when the same plugin is installed in multiple projects — fixed.
  • MCP tools that connect mid-turn being deferred for tool search without their names announced to the model — fixed.

Sandbox

  • Sandbox filesystem deny entries written with a trailing slash (e.g. denyRead: "~/.aws/") being silently bypassable on Linux and macOS — fixed.
  • Sandbox violation details never appearing in Bash tool results — fixed; Claude now sees which file or network access was denied and why.

Messaging & input

  • SendMessage reporting “Message sent” when the write to a teammate’s inbox had actually failed — fixed; failed deliveries are now reported as errors.
  • Recalled or restored paste content occasionally attaching wrong data or silently losing text — fixed; this happened when the paste had aged out or placeholder numbers collided.
  • Copy-on-select on Wayland sometimes not reaching the clipboard — fixed; the two selection writes no longer race.
  • The feedback survey’s transcript share silently failing on long sessions — fixed; a failed share now shows an error instead of a success message.

Remote Control

  • Remote Control auto-start intermittently failing with “Remote credentials fetch failed” on a cold start with a stale login token — fixed.
  • Remote Control and SDK clients showing a blank “(no content)” message after /clear and other output-less commands — fixed.
  • A Remote Control session recreated after its server session expired uploading prior local conversation history into the new session — fixed.
  • A session resume silently reconnecting Remote Control after the user turned it off — fixed, covering --resume, SDK hosts, and the VS Code extension.
  • [VSCode] The extension showing Remote Control as connected after the connection failed — fixed.
  • [VSCode] Sessions not honoring remoteControlAtStartup when explicitly enabled — fixed.

Notes

  • Self-hosted runners are a Team and Enterprise feature — other plans can’t use them.
  • Cross-session SendMessage is macOS and Linux — those are the platforms listed for this release.
  • Credential masking has prerequisites — the new options need network.tlsTerminate and are honored only from user, managed, or --settings settings; values set elsewhere are ignored.
  • The transcript share now covers more — sharing a transcript from the feedback survey uploads your system prompt, which includes your CLAUDE.md instructions. It’s consent-gated and secrets are redacted, but worth knowing what goes with it.
  • This release carries a security fix — sandbox deny entries written with a trailing slash were silently bypassable on Linux and macOS. If your denyRead/denyWrite entries are written that way, upgrade.
  • Removing the subagent cap doesn’t remove the others — concurrency and depth limits still apply.