Claude Code v2.1.224 Major Updates - Self-Hosted Environments and Cross-Session Messaging

This is Ishikawa from the Cloud Business Division. Claude Code v2.1.224 (released 2026-08-07) has been released. This update includes many new features and is packed with noteworthy updates. I'm trying out the new feature "SendMessage and ListAgents across sessions."

The previous update article is here.

https://dev.classmethod.jp/articles/20260806-cc-updates-v2-1-223/

Update Summary

v2.1.224 includes 31 changes. The breakdown is 5 new features, 5 security-related items, 13 fixes, with the remainder being improvements and display-related changes. By feature, Remote Control-related items are the most numerous at 9, making this a release that intensively addressed web and mobile usage.

Notable Updates

claude self-hosted-runner for Building Self-Hosted Environments

A new claude self-hosted-runner command has been added. It allows you to make your own machine or container the place where Claude Code web, mobile, and desktop sessions run. This targets Team and Enterprise plans.

For organizations that want to run web and mobile sessions in an environment confined to their own network or container images, this feels like one more option added to their choices.

SendMessage and ListAgents Across Sessions

Cross-session SendMessage has been added, enabling Claude Code sessions to exchange messages with each other. Messages can be sent across multiple machines on hand, and ListAgents is used to discover recipients. Support is for macOS and Linux.

Along with this, settings for crossSessionInbound and dialogExpiry have been added. Messages sent to a running session that bypass permissions are held pending approval, while messages to other sessions are automatically delivered.

I feel this enables connecting work that was previously closed within each session, by passing the results of one session to another.

ANTHROPIC_BEDROCK_REGION_PREFIX for Bedrock

The ANTHROPIC_BEDROCK_REGION_PREFIX environment variable has been added for Bedrock. It takes priority over what is derived from AWS_REGION, allowing you to select a specific cross-region inference profile.

For those using Bedrock and wanting to use a cross-region inference profile different from what is determined by AWS_REGION, this feels like it can now be specified with a single environment variable.

Fixed Issue Where Sandbox Deny Settings Could Be Bypassed with Trailing Slash

A problem has been fixed where sandbox filesystem deny settings written with a trailing slash (e.g., denyRead: "~/.aws/") could be unknowingly bypassed on Linux and macOS.

For those who had written deny settings with a trailing slash, there is a possibility that the intended deny was not taking effect, so it feels worth reviewing your settings along with the update.

Extended Sandbox Credential Masking

Options have been added to sandbox credential masking. extract and onExtractNoMatch for structured environment variable values, decode: "jwt" and maskClaims for interpreting and masking JWTs, and awsPairs/sigv4 for re-signing AWS SigV4 are now available. These require network.tlsTerminate and are only enabled from user settings, managed settings, and settings via --settings.

For workloads handling AWS credentials or JWTs through the sandbox, I feel there is now more room to increase the granularity of masking.

Expanded Scope of What Is Sent When Sharing Transcripts in Feedback Surveys

The behavior of transcript sharing in feedback surveys has changed. With user consent, the model settings of the most recent request—that is, the system prompt (including instructions in CLAUDE.md), tool definitions, and model parameters—are now also uploaded. Secrets continue to be kept confidential as before, and if the shared size is too large, these fields are the first to be trimmed.

When sharing transcripts in feedback surveys, I feel it comes down to deciding with the premise that the contents of CLAUDE.md will also be sent.

Fixed Session Mix-up Caused by Long Project Paths

A problem has been fixed where long project paths exceeding 200 characters, after sanitization, shared a common prefix and resolved to a different project's session directory. Session listing, renaming, forking, deletion, and /resume no longer cross project boundaries.

For those who have felt that /resume candidates were strange for projects placed deep in directory hierarchies, I think this version may have resolved it.

Update Details

New Features

• Self-hosted environment via claude self-hosted-runner (Team and Enterprise plans)
• Cross-session SendMessage and ListAgents for discovering recipients (macOS and Linux)
• Settings for crossSessionInbound and dialogExpiry
• Sandbox credential masking options (extract / onExtractNoMatch / decode: "jwt" and maskClaims / awsPairs・sigv4)
• ANTHROPIC_BEDROCK_REGION_PREFIX environment variable for Bedrock
• archive plugin source. Plugins can be installed from zip files via HTTPS without using git or npm, and SHA-256 pinning can optionally be specified
• Cancel and confirmation steps when command text changes due to deletion of unavailable pastes

Improvements

• In fullscreen mode, the entire pre-compaction history is now retained in the scrollback even after repeated compactions (previously only the most recent interval)
• In Remote Control, compaction progress and boundaries are now visible to connected web and mobile clients, and resets via /clear are also now communicated
• On Remote Control connection failure, instead of a toast that disappears after 8 seconds, a persistent failure indicator with details and a reconnect shortcut is now displayed
• The launch limit of 200 sub-agents per session has been removed (limits on parallelism and depth continue to apply)
• In managed settings, approval prompts are no longer re-displayed after re-login or organization switching when the organization's settings have not changed
• In Remote Control, when a new session is created after compaction or /resume, the old server session is now archived
• Placeholder numbers of re-invoked pastes are now renumbered at the point they are incorporated into input
• The Bash tool description now explicitly states that command output is visible to the model but is not guaranteed to be visible to the user

Fixes

• Fixed session mix-up caused by long project paths: The problem where paths exceeding 200 characters resolved to a different project's session directory has been resolved
• Fixed conversation history carryover in Remote Control: The problem where a session recreated after the server-side session expired would upload prior local conversation history to the new session has been resolved
• Fixed false success reporting in SendMessage: The problem where "Message sent" was reported even when writing to the recipient's inbox had failed has been resolved, and delivery failures are now reported as errors
• Fixed deficiency in delayed MCP tool registration: The problem where MCP tools connected mid-turn were treated as delayed tools without informing the model of their names has been resolved
• Fixed corruption of plugin installation records: The problem where records became corrupted when the same plugin was installed in multiple projects has been resolved
• Fixed paste content mix-up: The problem where re-invoked/restored pastes attached incorrect data or silently lost text upon expiration or placeholder number conflicts has been resolved
• Fixed Remote Control auto-start failure: The problem of intermittent failures with "Remote credentials fetch failed" on cold start with old login tokens has been resolved
• Fixed incorrect connection status display in VS Code extension: The problem of displaying Remote Control as connected even after a connection failure has been resolved
• Fixed Remote Control reconnecting when turned off: The problem of silent reconnection upon session resumption in --resume, SDK host, and VS Code extension has been resolved
• A quietly welcome fix: A problem where copy-on-select in Wayland sometimes did not reach the clipboard has been fixed. For those using Claude Code in a Linux desktop environment, I feel this is a fix that, while subtle, will have a daily impact
• In addition, minor bugs in feedback survey transcript sharing, empty message display after /clear, VS Code extension remoteControlAtStartup, and others have also been fixed.

Trying Out "Cross-Session SendMessage"

I'll verify whether messages between sessions actually arrive. To avoid accidentally sending to my own work session, I'll set up one verification session and make only that the send target.

1. Start Session A: In Terminal 1 (left), navigate to any project directory and start claude. Assign an easy-to-identify name with something like /rename session-a.

2. Start Session B: In Terminal 2 (right), start claude from a different project directory and name it /rename session-b.

3. Verify Sessions: In session-a, instruct "List other Claude Code sessions with the ListAgents tool." Verify that session-b appears in the results. Output is displayed in the format of ID, name, and state (working/idle, etc.).

4. Send a Message: In session-a, instruct "Send 'Reception test. If you receive this, respond with just "ACK"' to session-b via SendMessage."

5. Verify Message Receipt: On the Terminal 2 side, I was able to confirm that the message "ACK" arrived.

When I actually checked, two sockets had been created per session.

% ls -la /tmp/cc-socks/
total 0
drwx------@  4 ishikawa.satoru  wheel   128  8月  7 20:55 .
drwxrwxrwt  44 root             wheel  1408  8月  7 20:54 ..
srw-------@  1 ishikawa.satoru  wheel     0  8月  7 20:55 84536.sock
srw-------@  1 ishikawa.satoru  wheel     0  8月  7 20:55 84597.sock

ListAgents is a tool for discovering agents to which you can send messages (in-process sub-agents, local/cloud separate sessions, etc.), and SendMessage allows Claude Code sessions to send messages to each other, including those on different machines. The benefit is that multiple sessions can collaborate as a loosely coupled "agent team," enabling parallel division of tasks such as investigation, implementation, and review, while passing results and requests directly without manual transcription. Note that in auto mode, a safety measure is also in place where the permission classifier evaluates messages before they are sent.

Closing

v2.1.224 feels like a release where new features that expand the very scope in which Claude Code operates—such as self-hosted environments and cross-session messaging—arrived simultaneously with steady safety improvements around the sandbox. In particular, the bypass issue when deny settings were written with a trailing slash is one where the intended deny may not have been taking effect even though you thought you had configured it, so for those using the sandbox, I think it is worth checking sooner rather than later.

For those who regularly use the sandbox or Remote Control, why not update and give it a try?

References

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

https://code.claude.com/docs/en/changelog

https://dev.classmethod.jp/articles/20260806-cc-updates-v2-1-223/