v2.1.224
Claude CodeSummary
This release introduces self-hosted environments for Claude Code, allowing you to run sessions on your own infrastructure. You can now also install plugins from zip archives and message between Claude Code sessions on your machines. Several bugs have been fixed, including issues with long project paths, message sending failures, and sandbox violations.
New Features
- Added self-hosted environments, allowing you to use your own machines or containers as Claude Code execution environments on Team and Enterprise plans.
- Introduced the `archive` plugin source, enabling installation of plugins from a zip file over HTTPS without requiring git or npm, with optional SHA-256 pinning.
- Enabled a cancel-and-confirm step when removing unavailable pastes to prevent accidental changes to a command's text.
- Added `ANTHROPIC_BEDROCK_REGION_PREFIX` environment variable for Bedrock to specify a preferred cross-region inference profile.
- Introduced `crossSessionInbound` and `dialogExpiry` settings to manage cross-session messages, holding messages sent to sessions with bypassed permissions for your approval and auto-delivering messages to other sessions.
- Added sandbox credential-masking options including `extract`, `onExtractNoMatch`, `decode: "jwt"` with `maskClaims`, and `awsPairs`/`sigv4` for AWS SigV4 re-signing, requiring `network.tlsTerminate`.
- Enabled cross-session messaging between Claude Code sessions on any of your machines using `SendMessage` and `ListAgents` for discovery (macOS and Linux).
- Removed the 200-subagent-per-session spawn cap, allowing long-running sessions to accommodate new agents.
Bug Fixes
- Fixed an issue where long project paths (>200 characters) could incorrectly resolve to another project's session directory, preventing session list, rename, fork, delete, and `/resume` commands from crossing projects.
- Fixed `SendMessage` incorrectly reporting "Message sent" when the write to a teammate's inbox failed; failed deliveries are now reported as errors.
- Fixed sandbox filesystem deny entries with a trailing slash (e.g., `denyRead: "~/.aws/"`) being silently bypassable on Linux and macOS.
- Fixed sandbox violation details not appearing in Bash tool results, ensuring Claude now sees which file or network access was denied and why.
- Fixed MCP tools connecting mid-turn being deferred for tool search without their names being announced to the model.
- Fixed plugin install records being silently corrupted when the same plugin was installed in multiple projects.
- Fixed recalled or restored paste content occasionally attaching incorrect data or silently losing text when the paste had aged out or placeholder numbers collided.
- Fixed copy-on-select on Wayland not always reaching the clipboard due to a race condition between selection writes.
- Fixed the feedback survey's transcript share silently failing on long sessions; failed shares now display an error instead of a success message.
- Fixed Remote Control auto-start intermittently failing with "Remote credentials fetch failed" on a cold start with a stale login token.
- Fixed Remote Control and SDK clients showing a blank "(no content)" message after `/clear` and other output-less commands.
- Fixed a Remote Control session recreated after its server session expired uploading prior local conversation history into the new session.
- Fixed the VSCode extension showing Remote Control as connected after the connection failed.
- Fixed sessions not honoring `remoteControlAtStartup` when explicitly enabled in VSCode.
Improvements
- Improved fullscreen mode to retain the full pre-compaction history in scrollback across repeated compactions.
- Improved Remote Control to show compaction progress and the post-compaction boundary to attached web and mobile clients, and ensured `/clear` resets propagate to attached clients.
- Improved Remote Control connection failures to display a persistent failure indicator with details and a reconnect shortcut.
- Changed managed settings to prevent the approval prompt from reappearing after re-login or organization switching when settings are unchanged.
- Changed the feedback survey transcript share to optionally upload the last request's model settings (system prompt, tool definitions, model parameters) with consent, redacting secrets and dropping fields if the share is too large.
- Changed the Bash tool description to consistently note that command output is displayed to the model, not reliably to the user.
- Changed recalled paste placeholder numbers to renumber when accepted into the input.
- Changed Remote Control to archive stale server sessions instead of leaving them listed when a fresh session is minted after compaction or `/resume`.
- Fixed a session resume silently reconnecting Remote Control after the user turned it off.