claudekit / updates / claude-code-2-1-228
[ PATCH · ]

Claude Code 2.1.228

Skills synced from claude.ai are hardened: they no longer shadow local commands or MCP prompts, their descriptions are sanitized and labeled, and on your machine their bodies don't run ! commands or expand @ files. Two fixes stop things from being deleted that shouldn't be — session cleanup deleting contents inside a project's memory folder, and background plugin-cache cleanup deleting a plugin's cache when its only version is a symlinked development checkout. Also fixed: interactive sessions that could stop redrawing entirely while the process kept running, git and Git Bash not being found on Windows, and self-hosted runner sessions ending early.

Claude Code
Official announcement →

This article is a summary based on official documentation.

What changed

Claude Code 2.1.228 shipped on August 11, 2026. No new features — eleven fixes and seven other changes, with hardening for skills synced from claude.ai at the center of it. The paths where a skill pulled in from elsewhere could shadow a command on your machine or run shell commands locally are now closed. The rest of the release concentrates on two cases of deleting things nobody asked to delete, and on sessions that stopped or ended in the middle.

Key improvements

  • Skills synced from claude.ai are hardened

    A skill authored on claude.ai syncs down to Claude Code and runs locally. If its name collided with a slash command or MCP prompt you already had, it could shadow that one, and the ! (run a shell command) and @ (expand a file) markers in its body ran as written on your machine — so a skill pulled in from elsewhere could stand in for a local command or execute shell commands. Synced skills now no longer shadow local commands or MCP prompts, their descriptions are sanitized and labeled so you can tell they came from a sync, and on your machine their bodies don’t run ! commands or expand @ files.

  • Cross-session messages display inline

    A message from another session arrived as a collapsed line, so seeing who sent it and what it said took an extra step. The sender and body now display inline instead. Messages to Remote Control sessions on other machines show your Remote Control session name as the sender, so the receiving end can tell which session it came from.

  • The Write tool no longer requires a prior read for newer models

    The Write tool required that a file had been read in the current session before it could be overwritten. Newer models can now overwrite an existing file they haven’t read this session, matching the Edit tool’s rules. Older models still require the read first.

  • Vertex AI credentials fail fast when they’re expired

    Expired or missing Google Cloud credentials were treated as a transient error and retried for minutes, leaving you waiting with no indication of what was wrong. They now fail within seconds instead.

  • Compaction shows the retry countdown and stall hint

    During compaction (summarizing a long conversation to reclaim context) only a progress bar was shown, so there was no way to tell a retry apart from a slow run. The retry countdown and stall hint now appear during compaction as well.

  • Terminal tab jitter and an outdated notice

    The busy-spinner glyphs used in the terminal title were updated to reduce tab-bar jitter on some terminals. And the outdated note about auto mode sessions costing slightly more was removed from the first-use notice for Pro, Max, and Team plans.

Bug fixes

Rendering & session state

  • Interactive sessions that could stop redrawing entirely, while the process kept running, after a rare internal layout error — fixed.
  • /tui reverting the session to an earlier model when /model had been changed since the last response — fixed.

Things being deleted that shouldn’t be

  • Session cleanup deleting contents inside a project’s memory folder — fixed.
  • Background plugin-cache cleanup deleting a plugin’s cache when its only version is a symlinked development checkout — fixed.

Self-hosted runners & cross-session messaging

  • claude self-hosted-runner sessions failing on every fresh runner when the checkout hook fails for a repository the session doesn’t push to — fixed; that repository is now skipped with a warning.
  • Self-hosted runners ending sessions in the gap between a background task finishing and the follow-up turn starting — fixed.
  • Cross-session messaging sometimes starting without an inbox in the first session after install or upgrade — fixed.
  • Remote Control /resume while connected leaking the resumed conversation’s title or history into the connected session — fixed.

Settings & environment

  • git / Git Bash not being found on Windows when Claude Code is launched from a parent folder of the git installation — fixed.
  • A settings-merge issue where a marketplace entry redefined in a higher-precedence settings tier could inherit another tier’s custom headers — fixed; marketplace entries now merge as whole entries.
  • The deferred-tools reminder occasionally being sent to the model twice after a skill invocation — fixed.

Notes

  • The claude.ai skills hardening applies to local execution — the block on ! commands and @ file expansion in synced skill bodies is about running them on your machine. A skill written to depend on local command execution will behave differently once synced, so that kind of skill is better kept local.
  • The Write tool change depends on the model — only newer models can overwrite a file they haven’t read this session. Sessions on older models still require the read first.
  • A failing checkout hook now skips instead of stopping — when the hook fails for a repository the session doesn’t push to, that repository alone is skipped, with a warning. The warning is what tells you which repository was left out.
  • The marketplace merge change can alter existing setups — if the same marketplace entry is defined across several settings tiers, the higher-precedence entry is now used as a whole. If anything was relying on headers bleeding in from another tier, that setup needs a second look.
  • The memory-folder fix is forward-looking — it stops session cleanup from touching a project’s memory folder; it doesn’t restore anything already deleted.