Claude Code v2.1.224 Major Updates - Self-Hosted Environments and Cross-Session Messaging

This is Ishikawa from the Cloud Business Division. Claude Code v2.1.224 (released 2026-08-07) has been released. This update is packed with many new features and noteworthy changes. I'm trying out the new features "Cross-session SendMessage and ListAgents".

The previous update article is here.

https://dev.classmethod.jp/articles/20260806-cc-updates-v2-1-223/

Update Summary

v2.1.224 includes 31 changes. The breakdown is 5 new features, 5 security-related items, 13 fixes, with the rest being improvements and display-related changes. By feature area, Remote Control-related items are the most numerous at 9, making this a release that focused heavily on web and mobile usage.

Notable Updates

claude self-hosted-runner for Creating Self-Hosted Environments

A new claude self-hosted-runner command has been added. It allows you to make your own machine or container the place where Claude Code web, mobile, and desktop sessions run. This targets Team and Enterprise plans.

For organizations that want to run web and mobile sessions in an environment confined to their own network or container image, this feels like one more option added to the mix.

Cross-Session SendMessage and ListAgents

Cross-session SendMessage has been added, enabling Claude Code sessions to exchange messages with each other. Messages can be sent across multiple machines, and ListAgents is used to discover recipients. Support is for macOS and Linux.

Along with this, crossSessionInbound and dialogExpiry settings have been added. Messages sent to a running session that bypass permissions are held pending approval, while messages to other sessions are delivered automatically.

This feels like it enables work that was previously confined to individual sessions to be connected by passing results from one session to another.

ANTHROPIC_BEDROCK_REGION_PREFIX for Bedrock

The ANTHROPIC_BEDROCK_REGION_PREFIX environment variable has been added for Bedrock. It takes priority over what is derived from AWS_REGION, allowing you to select a specific cross-region inference profile.

For those using Claude Code via Bedrock who want to use a cross-region inference profile different from what AWS_REGION determines, this feels like it can now be specified with a single environment variable.

Fix for Sandbox Deny Settings Being Bypassed with Trailing Slash

A bug where sandbox filesystem deny settings written with a trailing slash (e.g., denyRead: "~/.aws/") could be silently bypassed on Linux and macOS has been fixed.

Those who wrote deny settings with a trailing slash may have had their intended denials not taking effect, so it feels worth reviewing your settings alongside the update.

Expanded Sandbox Credential Masking

Options have been added to sandbox credential masking. extract and onExtractNoMatch for structured environment variable values, decode: "jwt" and maskClaims for interpreting and masking JWTs, and awsPairs/sigv4 for AWS SigV4 re-signing are now available. These require network.tlsTerminate and are only enabled from user settings, managed settings, or settings passed via --settings.

For workloads that handle AWS credentials or JWTs through a sandbox, this feels like it expands the room to increase masking granularity.

Expanded Scope of Transcript Sharing in Feedback Surveys

The behavior of transcript sharing in feedback surveys has changed. With user consent, the model settings of the most recent request—namely the system prompt (including CLAUDE.md instructions), tool definitions, and model parameters—are now also uploaded. Secrets remain confidential as before, and if the shared size is too large, these fields are the first to be trimmed.

When sharing transcripts in feedback surveys, it feels like you'll need to make decisions with the understanding that the contents of CLAUDE.md will also be sent.

Fix for Session Confusion Caused by Long Project Paths

A bug where long project paths exceeding 200 characters, after sanitization, shared a common prefix and resolved to another project's session directory has been fixed. Session listing, renaming, forking, deletion, and /resume no longer cross project boundaries.

Those who have felt that /resume candidates seemed odd in deeply nested projects may find that this version has resolved the issue.

Update Details

New Features

• Self-hosted environment via claude self-hosted-runner (Team and Enterprise plans)
• Cross-session SendMessage and ListAgents for discovering recipients (macOS and Linux)
• crossSessionInbound and dialogExpiry settings
• Sandbox credential masking options (extract / onExtractNoMatch / decode: "jwt" and maskClaims / awsPairs・sigv4)
• ANTHROPIC_BEDROCK_REGION_PREFIX environment variable for Bedrock
• archive plugin source. Plugins can be installed from zip files via HTTPS without using git or npm, with optional SHA-256 pinning
• Cancel and confirmation steps when a paste that is no longer available is removed, causing the command text to change

Improvements

• In full-screen mode, the entire pre-compaction history is now retained in the scrollback even after repeated compactions (previously only the most recent segment)
• In Remote Control, connected web and mobile clients can now see compaction progress and boundaries, and /clear resets are now propagated
• On Remote Control connection failure, a persistent failure indicator with details and a reconnect shortcut is now shown instead of a toast that disappears after 8 seconds
• The 200 sub-agent startup limit per session has been removed (parallel count and depth limits still apply)
• In managed settings, approval prompts no longer re-appear after re-login or organization switching when the organization's settings haven't changed
• In Remote Control, old server sessions are now archived when a new session is created after compaction or /resume
• Placeholder numbers for recalled pastes are now reassigned at the point they are incorporated into the input
• The Bash tool description now explicitly states that command output is visible to the model but not necessarily guaranteed to be visible to the user

Fixes

• Fix for session confusion caused by long project paths: The issue where paths exceeding 200 characters resolved to another project's session directory has been resolved
• Fix for conversation history carry-over in Remote Control: The issue where a session recreated after the server-side session expired would upload prior local conversation history to the new session has been resolved
• Fix for false success reporting in SendMessage: The issue where "Message sent" was reported even when writing to the recipient's inbox failed has been resolved, and delivery failures are now reported as errors
• Fix for delayed MCP tool registration issues: The issue where MCP tools connected mid-turn were treated as delayed tools without informing the model of their names has been resolved
• Fix for plugin installation record corruption: The issue where records became corrupted when installing the same plugin in multiple projects has been resolved
• Fix for paste content confusion: The issue where recalled/restored pastes attached incorrect data or silently lost text upon expiration or placeholder number conflicts has been resolved
• Fix for Remote Control auto-start failures: The issue where cold starts with old login tokens intermittently failed with "Remote credentials fetch failed" has been resolved
• Fix for incorrect connection status display in VS Code extension: The issue where Remote Control was displayed as connected even after a connection failure has been resolved
• Fix for Remote Control reconnecting when turned off: The issue where --resume, SDK host, and VS Code extension silently reconnected on session resumption has been resolved
• A quietly welcome fix: An issue where selection-based copying on Wayland sometimes didn't reach the clipboard has been fixed. For those using Claude Code in a Linux desktop environment, this feels like a fix that will have a quietly meaningful impact day to day
• In addition, minor bugs have been fixed including feedback survey transcript sharing, empty message display after /clear, and remoteControlAtStartup in the VS Code extension.

Trying Out "Cross-Session SendMessage"

Let's verify whether inter-session messaging actually works. To avoid accidentally sending to my own work session, I'll set up one dedicated verification session and use only that as the send target.

1. Start Session A: In Terminal 1 (left), navigate to any project directory and launch claude. Give it an easy-to-identify name like /rename session-a.

2. Start Session B: In Terminal 2 (right), launch claude from a different project directory and name it /rename session-b.

3. Check Sessions: In session-a, give the instruction "List other Claude Code sessions with the ListAgents tool". Check whether session-b appears in the results. The output is formatted showing the ID, name, and status (working/idle, etc.) of each session.

4. Send a Message: In session-a, give the instruction "Send a message to session-b via SendMessage saying 'Reception test. If you receive this, respond with only "ACK"'".

5. Confirm Message Receipt: On the Terminal 2 side, observe how the message arrives (whether it's injected as a prompt or appears as a notification) and whether Claude reacts and starts a turn in response.

Upon checking, one socket was created per session.

% ls -la /tmp/cc-socks/
total 0
drwx------@  4 ishikawa.satoru  wheel   128  8月  7 20:55 .
drwxrwxrwt  44 root             wheel  1408  8月  7 20:54 ..
srw-------@  1 ishikawa.satoru  wheel     0  8月  7 20:55 84536.sock
srw-------@  1 ishikawa.satoru  wheel     0  8月  7 20:55 84597.sock

ListAgents is a tool for discovering agents to which you can send messages (in-process sub-agents, local/cloud separate sessions, etc.), and SendMessage allows Claude Code sessions—including those on different machines—to send messages to each other. The benefit is that multiple sessions can be coordinated as a loosely coupled "agent team," enabling parallel division of tasks like investigation, implementation, and review, while passing results and requests directly without manual transcription. Note that in auto mode, a safety measure is in place where a permission classifier evaluates messages before they are sent.

Closing Thoughts

v2.1.224 feels like a release that simultaneously introduces new features expanding the very scope of where Claude Code operates—such as self-hosted environments and inter-session messaging—while also steadily improving safety around the sandbox. In particular, the bypass issue for deny settings written with a trailing slash is one where the intended denial may have not been taking effect despite being configured, so those using sandboxes may want to verify their settings sooner rather than later.

Those who regularly use sandboxes or Remote Control might want to update and give the new features a try.

References

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

https://code.claude.com/docs/en/changelog

https://dev.classmethod.jp/articles/20260806-cc-updates-v2-1-223/