Self-Hosted Runners and Cross-Session Messages Arrive! Claude Code Updates to v2.1.224

Hey, it's Shiichan! I've got another Claude Code update for you today!

Claude Code Release github.com

What was announced?

According to the Claude Code Release page on GitHub, v2.1.224 just shipped. The headline features are self-hosted environments for running sessions on your own machines, and the ability for Claude Code sessions to message each other directly. On top of that, sandbox credential masking got stronger, plugins gained a new distribution option, and a long list of fixes and improvements landed too.

The story so far

Until now, Claude Code's web, mobile, and desktop sessions could only run on execution environments Anthropic provided. And even when you had multiple sessions running at once, there was no way for them to talk to each other directly. Subagents were also capped at 200 per session, so long-running sessions could eventually lose the ability to spawn new agents. On the smaller side, a handful of bugs lingered in sandbox deny rules, the paste feature, and how Remote Control showed connection state.

What changes

Let's start with the headline new features.

• Added claude self-hosted-runner: your own machines or containers can now host Claude Code web, mobile, and desktop sessions (available on Team and Enterprise plans)
• Added the archive plugin source: install plugins from a zip file over HTTPS, no git or npm required, with optional SHA-256 pinning
• Added cross-session SendMessage: Claude Code sessions can message each other regardless of which machine they're on, and ListAgents helps you find them (macOS and Linux)
• Added crossSessionInbound and dialogExpiry settings: cross-session messages sent to a session running with bypassed permissions are now held for your approval, while messages to other sessions deliver automatically
• Strengthened sandbox credential masking: extract and onExtractNoMatch for structured env values, decode: "jwt" with maskClaims for JWT-aware masking, and awsPairs/sigv4 for AWS SigV4 re-signing (these require network.tlsTerminate and are only honored from user, managed, or --settings settings)
• Added an ANTHROPIC_BEDROCK_REGION_PREFIX env var for Bedrock, letting you prefer a specific cross-region inference profile over the one derived from AWS_REGION

Subagents changed too: the 200-subagent-per-session spawn cap is gone (concurrency and depth limits still apply). Long-running sessions won't hit a wall when they need to create more agents.

Dive Deep

There's a big batch of fixes in this release too, so here's a rundown of the ones worth knowing about.

Security and sandboxing:

• Fixed sandbox deny entries with a trailing slash (e.g. denyRead: "~/.aws/") being silently bypassable on Linux and macOS
• Fixed sandbox violation details never appearing in Bash tool results, so Claude now sees which file or network access was denied and why

Sessions and Remote Control:

• Fixed long (>200 char) project paths resolving to another project's session directory under a shared sanitized prefix; session list, rename, fork, delete, and /resume no longer cross projects
• Fixed SendMessage reporting "Message sent" even when the write to a teammate's inbox had actually failed; failed deliveries are now reported as errors
• Fixed Remote Control auto-start intermittently failing with "Remote credentials fetch failed" on a cold start with a stale login token
• Fixed Remote Control and SDK clients showing a blank "(no content)" message after /clear and other output-less commands
• Fixed a Remote Control session recreated after its server session expired uploading prior local conversation history into the new session
• Improved fullscreen mode to keep the full pre-compaction history in scrollback across repeated compactions, instead of only the most recent interval
• Improved Remote Control so attached web and mobile clients see compaction progress and the post-compaction boundary instead of a silent pause, and /clear resets now propagate to attached clients
• Improved Remote Control connection failures to show a persistent indicator with details and a reconnect shortcut, instead of only an 8-second toast

A few smaller fixes:

• Fixed plugin install records being silently corrupted when the same plugin is installed in multiple projects
• Fixed recalled or restored paste content occasionally attaching wrong data or silently losing text when the paste had aged out or placeholder numbers collided
• Fixed copy-on-select on Wayland sometimes not reaching the clipboard, where two selection writes were racing
• Fixed the feedback survey's transcript share silently failing on long sessions; a failed share now shows an error instead of a success message

A couple of behavior changes landed too. The managed-settings approval prompt no longer re-appears after re-login or org switching when the organization's settings are unchanged. And the feedback survey's transcript share, with your consent, now also uploads the last request's model settings — the system prompt (which includes your CLAUDE.md instructions), tool definitions, and model parameters. Secrets are still redacted, and these fields get dropped first if the share is too large.

Wrap-up

• Added claude self-hosted-runner so your own machines can run sessions (Team and Enterprise plans)
• Added cross-session SendMessage and ListAgents so Claude Code sessions can message each other
• Strengthened sandbox credential masking, now with JWT and AWS SigV4 support
• Removed the 200-subagent-per-session spawn cap
• A long list of fixes and improvements around sandbox loopholes and Remote Control's display and connection handling

If you run sessions across multiple machines, or you customize sandboxing and plugin distribution, this update is worth a close look.