Claude Code v2.1.222 Major Updates - Security fix for worktree isolation and removal of ultraplan
This page has been translated by machine translation. View original
This is Ishikawa from the Cloud Business Division. Claude Code v2.1.222 (released 2026-08-04) has been released. Rather than adding new features, this update consists of fixes related to permission checks and session isolation — a quietly significant update that shouldn't be overlooked.
The previous update article is here.
Update Summary
v2.1.222 includes 21 changes. The breakdown is 14 fixes, 3 security-related, 2 breaking changes, and 2 improvements.
The breaking changes are the removal of ultraplan and a change related to Remote Control auto-start. Since both affect existing usage, they are covered in dedicated sections later.
Notable Updates
Fixed issue where destructive git commands could be executed from isolated worktree sessions
A fix was made for an issue where sessions isolated in a worktree and their sub-agents could execute destructive git commands against the main checkout. Isolation now applies to file editing and Bash across all session types.
For those running sub-agents in worktrees for parallel work, this is reason to update promptly.
Fixed issue where PreToolUse auto-approval hooks bypassed tool restrictions
A fix was made for an issue where PreToolUse auto-approval hooks in background agent tasks (summary generation, compaction, rename) bypassed tool restrictions.
If you have auto-approval set up in PreToolUse hooks, this is a good opportunity to review whether your intended restrictions are actually taking effect.
SendMessage now goes through the permission classifier in auto mode
Safety in auto mode has been improved — messages sent to other agent sessions via SendMessage are now evaluated by the permission classifier before dispatch.
As use cases involving agent-to-agent collaboration increase, having this kind of path checked is a welcome improvement.
Update Details
Improvements
- The rejection message when Claude attempts to call a skill with
disable-model-invocationspecified has been improved. Claude is now instructed to ask the user to execute the skill rather than trying to reproduce the workflow itself. /diffdisplay, Remote Control workspace diffs, and file edit diffs in Claude Code on the web sessions now use raw git blob content, ignoring any diff drivers or textconv configured in the workspace.
Fixes
- Fixed startup connection check hang under HTTPS proxy: Now uses the same proxy-aware transport as API requests and times out with a clear message.
- Fixed erroneous error display on completed responses: Resolved an issue where "Connection closed mid-response" errors were reported for responses that had actually completed successfully.
- Fixed MCP server usage overcounting in
/usage: Per-server allocation now only reflects requests that actually consumed that tool's results. Previously, all turns after a single invocation were counted. - Fixed stream idle timeout with custom gateways: Resolved an issue where timeouts were firing on custom
ANTHROPIC_BASE_URLgateways despite keep-alive pings arriving from the server. - Fixed model alias fallback for organization-restricted models: Family aliases for sub-agents and teammates such as
model: opusnow gracefully fall back to the latest model permitted by the organization within the same family, rather than falling back to the parent model. - Fixed Team/Enterprise
/usage-creditsresubmission issue: Resolved an issue where members whose past requests were rejected were shown "already submitted a usage credits request" and were unable to send new requests. - Fixed rare crash caused by file watcher: Resolved crashes that occurred when encountering filesystem errors and during shutdown processing.
- A quietly welcome fix: In sub-agent transcript display, the spinner's effort label was showing the session's effort level rather than the sub-agent's own
effort:setting. If you varyeffort:per sub-agent, the display alone was misrepresenting reality. A minor point, but it's reassuring not to have to question the behavior. - Additionally, numerous minor bugs have been fixed including: linking pull requests to sessions, authorization display for claude.ai connectors, tool error display after MCP server removal, long summaries in
SendMessage, screen reader support (--ax-screen-reader), and priority handling betweenmanaged-settings.jsonand host-side model selection keys.
Breaking Changes / Deprecations
Removal of the ultraplan feature
The ultraplan feature has been removed. According to past version entries in the official CHANGELOG, ultraplan was a feature for refining plans in remote sessions, provided as the /ultraplan command and the "Refine with Ultraplan" option in plan mode.
Remote Control auto-start can no longer be enabled via repository-local settings
Remote Control auto-start has been changed so that it can no longer be enabled via repository-local settings (.claude/settings.json / .claude/settings.local.json). Disabling it remains possible. To enable it, configure it at user scope via /config.
- Before the change (up to v2.1.221)
- Remote Control auto-start could be enabled
- It could also be disabled
- After the change (v2.1.222 onwards)
- Only disabling is possible (enabling is not available)
- For user scope, enable it via
/config
Closing
v2.1.222 has no new features, but it is focused on improving security and stability, and I feel the update priority is high. In particular, the two fixes for worktree isolation and PreToolUse hooks will have greater impact on those who delegate permissions to agents.
For those running sub-agents in worktrees, and teams operating Remote Control via repository configuration files, why not update and give it a try?
References
