--- title: "Claude Code v2.1.224 Released: Self-Hosted Runners, Cross-Session Messaging, and Sandbox Credential Masking" source: "Claude Code：GitHub Releases（RSS）" source_tier: "t1_5" url: "https://github.com/anthropics/claude-code/releases/tag/v2.1.224" permalink: "https://feed.astralor.com/items/itm_1d4c01b0fd7d59563cebdba8" published: "2026-08-07T04:00:59.000Z" score: 79 channel: "ai" tags: ["Anthropic","AWS Bedrock","Claude Code","MCP","Sandbox","Self-hosted"] --- # Claude Code v2.1.224 Released: Self-Hosted Runners, Cross-Session Messaging, and Sandbox Credential Masking ## AI commentary > The standout features are self-hosted runners and cross-session messaging, which turn Claude Code from a single-machine tool into a collaboration platform that fits enterprise infrastructure. For platform and security teams, the sandbox credential masking and deny-rule fixes are just as critical. If you're on Team or Enterprise, upgrade soon. ## At a glance Claude Code v2.1.224 introduces enterprise features including self-hosted runners that let your own machines or containers execute web, mobile, and desktop sessions, plus a new plugin source over HTTPS with SHA-256 pinning. Cross-session messaging now lets sessions talk to each other with ListAgents discovery, while sandbox credential masking adds JWT-aware decoding and AWS SigV4 re-signing. Key bug fixes address project path collisions, sandbox filesystem bypasses, MCP tool delays, and clipboard issues. The 200-subagent-per-session cap has been removed, and Remote Control improvements include better compaction progress and failure indicators. ## Key points - Self-hosted runners: claude self-hosted-runner turns your own machines or containers into execution environments for Claude Code web, mobile, and desktop sessions, available on Team and Enterprise plans. - Cross-session messaging: Claude Code sessions can now message each other on any of your machines, with ListAgents for discovery. - Sandbox credential masking: new extract/onExtractNoMatch, JWT decode, and AWS SigV4 re-signing options strengthen secret handling. - Removed the 200-subagent-per-session spawn cap, and fixed multiple issues related to project paths, plugin installation, and Remote Control. ## Full text What's changed Added self-hosted environments: claude self-hosted-runner turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions can run, on Team and Enterprise plans Added archive plugin source: install plugins from a zip over HTTPS without git or npm, with optional SHA-256 pinning Added a cancel-and-confirm step when removing an unavailable paste changes a command's text Added ANTHROPIC_BEDROCK_REGION_PREFIX env var for Bedrock to prefer a specific cross-region inference profile over the AWS_REGION-derived one Added crossSessionInbound and dialogExpiry settings: cross-session messages sent to a session running with bypassed permissions are held for your approval, and messages to other sessions auto-deliver Added sandbox credential-masking options: extract and onExtractNoMatch for structured env values, decode: "jwt" with maskClaims for JWT-aware masking, and awsPairs/sigv4 for AWS SigV4 re-signing; these need network.tlsTerminate and are honored only from user, managed, or --settings settings Added cross-session SendMessage: Claude Code sessions can now message each other, on any of your machines, with ListAgents to discover them (macOS and Linux) Fixed long (>200 char) project paths resolving to another project's session directory under a shared sanitized prefix; session list, rename, fork, delete and /resume no longer cross projects Fixed SendMessage reporting "Message sent" when the write to a teammate's inbox had actually failed; failed deliveries are now reported as errors Fixed sandbox filesystem deny entries written with a trailing slash (e.g. denyRead: "~/.aws/") being silently bypassable on Linux and macOS Fixed sandbox violation details never appearing in Bash tool results; Claude now sees which file or network access was denied and why Fixed MCP tools that connect mid-turn being deferred for tool search without their names announced to the model Fixed plugin install records being silently corrupted when the same plugin is installed in multiple projects Fixed recalled or restored paste content occasionally attaching wrong data or silently losing text when the paste had aged out or placeholder numbers collided Fixed copy-on-select on Wayland sometimes not reaching the clipboard; the two selection writes no longer race Fixed the feedback survey's transcript share silently failing on long sessions; a failed share now shows an error instead of a success message Fixed Remote Control auto-start intermittently failing with "Remote credentials fetch failed" on a cold start with a stale login token Fixed Remote Control and SDK clients showing a blank "(no content)" message after /clear and other output-less commands Fixed a Remote Control session recreated after its server session expired uploading prior local conversation history into the new session Improved fullscreen mode to keep the full pre-compaction history in scrollback across repeated compactions, instead of only the most recent interval Improved Remote Control: attached web and mobile clients now see compaction progress and the post-compaction boundary instead of a silent pause; /clear resets now propagate to attached clients Improved Remote Control: connection failures now show a persistent failure indicator with details and a reconnect shortcut, instead of only an 8-second toast Removed the 200-subagent-per-session spawn cap; long-running sessions no longer refuse new agents (concurrency and depth limits still apply) Changed managed settings: the approval prompt no longer re-appears after re-login or org switching when the organization's settings are unchanged Changed the feedback-survey transcript share: with your consent it now also uploads the last request's model settings — the system prompt (which includes your CLAUDE.md instructions), tool definitions, and model parameters. Secrets are redacted as before, and these fields are dropped first if the share is too large Changed the Bash tool description to always note that command output is displayed to the model, not reliably to the user Changed recalled paste placeholder numbers to renumber when accepted into the input Changed Remote Control to archive the stale server session instead of leaving a dead one listed when a fresh session is minted after compaction or /resume [VSCode] Fixed the extension showing Remote Control as connected after the connection failed Fixed a session resume silently reconnecting Remote Control after the user turned it off (--resume, SDK hosts, and the VS Code extension) [VSCode] Fixed sessions not honoring remoteControlAtStartup when explicitly enabled --- Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_1d4c01b0fd7d59563cebdba8