claudekit / updates / claude-code-2-1-222
[ PATCH · ]

Claude Code 2.1.222

Worktree-isolated sessions and their subagents could run destructive git commands against the main checkout — isolation now applies to file edits and Bash in every session type, and PreToolUse auto-allow hooks no longer bypass tool restrictions in background agent tasks. In auto mode, messages sent to other agent sessions via SendMessage are now evaluated by the permission classifier before dispatch. Remote Control auto-start can no longer be turned on by repo-local settings (they can still turn it off) — enable it at user scope via /config — and the ultraplan feature is removed. Also fixed: the startup connectivity check hanging behind an HTTPS proxy, and /usage overattributing usage to MCP servers.

Claude Code
Official announcement →

This article is a summary based on official documentation.

What changed

Claude Code 2.1.222 shipped on August 4, 2026. The center of the release is closing paths where isolation and permission checks were not actually being applied: worktree-isolated sessions could reach the main checkout with destructive git commands, and PreToolUse auto-allow hooks could bypass tool restrictions in background agent tasks. Alongside those, a set of environment-dependent behaviors gets corrected — connectivity checks behind a proxy, /usage attribution, and org-restricted model family aliases — Remote Control auto-start changes scope, and the ultraplan feature is removed.

Key improvements

  • SendMessage goes through the permission classifier in auto mode

    Messages dispatched to other agent sessions were not evaluated against permissions at all. Auto mode safety is improved: messages sent to other agent sessions via SendMessage are now evaluated by the permission classifier before dispatch.

  • Better refusal for skills with disable-model-invocation

    When Claude tried to invoke a skill marked disable-model-invocation, the refusal left the next step undefined, and Claude sometimes replicated the skill’s workflow itself. Claude is now told to ask you to run the skill instead of replicating its workflow.

  • Diffs use raw git blob content

    The /diff view, the Remote Control workspace diff, and file-edit diffs in Claude Code on the web sessions followed workspace-configured diff drivers and textconv, so transformed content could be shown. All three now use raw git blob content, ignoring those settings.

  • Remote Control auto-start moves to user scope

    Repo-local settings (.claude/settings.json or .claude/settings.local.json) could turn Remote Control auto-start on. They can no longer turn it on — only off. Enable it at user scope via /config.

  • Removed ultraplan feature

    The ultraplan feature is removed in this release.

Bug fixes

Isolation & permissions

  • Worktree-isolated sessions and their subagents being able to run destructive git commands against the main checkout — fixed; isolation now applies to file edits and Bash in every session type.
  • PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasks (summaries, compaction, renames) — fixed.

Network & connectivity

  • The startup connectivity check hanging and then failing behind an HTTPS proxy — fixed; it now uses the same proxy-aware transport as API requests and times out with a clear message.
  • “Connection closed mid-response” errors being reported on responses that had actually completed — fixed.
  • Stream idle timeout firing on custom ANTHROPIC_BASE_URL gateways despite server keep-alive pings arriving on the wire — fixed.
  • claude.ai connectors being falsely marked as needing authorization when the session token is invalid — fixed; they now show a /login hint instead.

Usage & model selection

  • /usage-credits on Team and Enterprise showing “you’ve already sent a usage credit request” for members whose earlier request was dismissed — fixed; it no longer blocks them from sending a new one.
  • /usage overattributing usage to MCP servers — fixed; a server’s share now reflects only the requests that actually consumed its tool results, instead of every turn after any call to it.
  • Org-restricted model: opus-style subagent and teammate family aliases dropping to the parent model — fixed; they now step down to the newest org-allowed model in the family.
  • Host model-selection keys not taking precedence over a stale on-disk managed-settings.json when CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is set — fixed.

Sessions & display

  • Sessions not linking to pull requests created after the branch was pushed, including through the GitHub REST API — fixed.
  • Tool errors not being displayed for tools no longer available locally, for example after an MCP server is removed — fixed.
  • SendMessage rejecting a long summary — fixed; it now truncates instead, so sends no longer fail on a character limit.
  • The spinner’s effort label in a subagent’s transcript view showing the session’s effort level instead of the subagent’s own effort: setting — fixed.
  • Rare crashes when a file watcher hit a filesystem error or during file-watcher teardown — fixed.
  • Screen readers re-reading the whole input line on every backspace in --ax-screen-reader mode — fixed; end-of-line deletions now echo just the deleted characters.

Notes

  • Isolation now covers more than git — it applies to file edits and Bash in every session type. Work in an isolated session that reached back into the main checkout will be blocked after upgrading.
  • Re-check PreToolUse auto-allow hooks — the path that let them bypass tool restrictions in background agent tasks is closed, so setups relying on hook-based auto-allow may behave differently after upgrading.
  • Remote Control auto-start must be enabled at user scope — if it was turned on from repo-local settings, it will not start after upgrading. Re-enable it via /config at user scope; repo-local settings can still turn it off.
  • /usage MCP numbers will shift — the attribution rule changed, so a server’s share can read lower than before. Don’t compare pre- and post-upgrade numbers directly.
  • ultraplan is gone — the release notes list no replacement path for it.