JA EN
shiichan

Blocking Destructive Git Commands: Claude Code Updates to v2.1.222

Claude Code Release ★★★★ View Markdown
#anthropic#ai#devops

Hey, it's Shiichan! Today's update is about my favorite tool, Claude Code!

Claude Code Release github.com

What was announced?

According to the Claude Code Release page on GitHub, v2.1.222 just shipped. It centers on security fixes for worktree isolation and background agents, along with fixes for proxy-related connection issues, display bugs in /usage and /usage-credits, and a batch of smaller bug fixes.

The story so far

Worktree-isolated sessions were supposed to be isolated, but there was a gap where the session and its subagents could still run destructive git commands against the main checkout. Background agent tasks (like summaries, compaction, and renames) also had a gap where PreToolUse auto-allow hooks could bypass tool restrictions. On top of that, there were a few networking annoyances: the startup connectivity check could hang and fail behind an HTTPS proxy, and on custom ANTHROPIC_BASE_URL gateways the stream idle timeout could fire incorrectly even while the server's keep-alive pings were still arriving.

What changes

The security fixes stand out first.

  • Fixed worktree-isolated sessions and their subagents being able to run destructive git commands against the main checkout — isolation now applies to both file edits and Bash in every session type
  • Fixed PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasks (summaries, compaction, renames)
  • Improved auto mode safety: messages sent to other agent sessions via SendMessage are now evaluated by the permission classifier before dispatch

Connectivity got some welcome fixes too.

  • Fixed the startup connectivity check hanging and then failing behind an HTTPS proxy; it now uses the same proxy-aware transport as API requests and times out with a clear message
  • Fixed "Connection closed mid-response" errors being reported on responses that had actually completed
  • Fixed the stream idle timeout firing on custom ANTHROPIC_BASE_URL gateways despite server keep-alive pings arriving on the wire

Dive Deep

There's plenty more worth calling out among the smaller fixes:

  • Fixed /usage-credits on Team and Enterprise showing "you've already sent a usage credit request" for members whose earlier request was dismissed, blocking them from sending a new one
  • Fixed /usage overattributing usage to MCP servers — a server's share now reflects only the requests that actually consumed its tool results, instead of every turn after any call to it
  • Fixed sessions not linking to pull requests created after the branch was pushed, including through the GitHub REST API
  • Fixed org-restricted model: opus-style subagent and teammate family aliases dropping straight to the parent model instead of stepping down to the newest org-allowed model within the family
  • Fixed claude.ai connectors being falsely marked as needing authorization when the session token is invalid — they now show a /login hint instead
  • Fixed tool errors not being displayed for tools no longer available locally, for example after an MCP server is removed
  • Fixed SendMessage rejecting a long summary — it now truncates instead, so sends no longer fail on a character limit
  • Fixed the spinner's effort label in a subagent's transcript view showing the session's effort level instead of the subagent's own effort: setting
  • Fixed rare crashes when a file watcher hit a filesystem error or during file-watcher teardown
  • Fixed screen readers re-reading the whole input line on every backspace in --ax-screen-reader mode — end-of-line deletions now echo just the deleted characters
  • Fixed host model-selection keys not taking precedence over a stale on-disk managed-settings.json when CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is set
  • Improved the refusal when Claude tries to invoke a skill with disable-model-invocation: Claude is now told to ask you to run the skill instead of replicating its workflow
  • Improved the /diff view, the Remote Control workspace diff, and file-edit diffs in Claude Code on the web to use raw git blob content, ignoring workspace-configured diff drivers and textconv

On the "changed" side, Remote Control auto-start rules shifted too: repo-local settings (.claude/settings.json or .claude/settings.local.json) can no longer turn it on, though they can still turn it off — you now enable it at the user scope via /config. The Ultraplan feature was also removed.

Wrap-up

  • Worktree isolation gets a security hardening pass, closing a destructive-git-command gap and a background-task permission bypass
  • SendMessage now runs through the permission classifier before dispatch, improving auto mode safety
  • Multiple connection fixes for HTTPS proxies and custom gateways
  • A long list of smaller fixes and improvements across /usage, /usage-credits, model fallback behavior, and screen reader support
  • Remote Control auto-start can now only be enabled at the user scope; the Ultraplan feature is gone

Whether you use Claude Code daily, rely on worktree isolation or background agents, or connect through a corporate proxy, this update is worth paying attention to for both security and stability.

Related posts