---
title: "Claude Code v2.1.224 发布：新增自托管 Runner、跨会话消息与沙箱凭据掩码"
source: "Claude Code：GitHub Releases（RSS）"
source_tier: "t1_5"
url: "https://github.com/anthropics/claude-code/releases/tag/v2.1.224"
permalink: "https://feed.astralor.com/items/itm_1d4c01b0fd7d59563cebdba8"
published: "2026-08-07T04:00:59.000Z"
score: 79
channel: "ai"
tags: ["Anthropic","AWS Bedrock","Claude Code","MCP","沙箱","自托管"]
---

# Claude Code v2.1.224 发布：新增自托管 Runner、跨会话消息与沙箱凭据掩码

## AI 点评

> 这个版本最值得关注的是自托管 runner 和跨会话消息，它们让 Claude Code 真正从单机工具变成了可嵌入企业基础设施的协作平台。对运维和平台团队来说，sandbox 凭据掩码和 deny 规则修复同样关键。如果你用 Team 或 Enterprise 计划，建议尽快升级。

## 速览

Claude Code v2.1.224 带来多项企业级功能：支持通过自托管 runner 将用户自有机器或容器接入会话，新增基于 HTTPS + SHA-256 的插件安装方式，以及跨会话消息传递和 Agent 发现。沙箱能力增强，支持 JWT 与 AWS SigV4 凭据掩码。同时修复了项目路径冲突、沙箱绕过等多个问题，并移除每会话 200 个子代理上限。

## 关键点

- 自托管 runner：可通过 claude self-hosted-runner 将自有机器或容器变成 Claude Code web、移动端和桌面会话的运行环境，适用于 Team 和 Enterprise 计划。
- 跨会话消息：Claude Code 会话现在可以互相发送消息，并支持 ListAgents 发现，可在多台机器上运行。
- 沙箱凭据掩码：新增 extract/onExtractNoMatch、JWT decode 与 AWS SigV4 重签等选项，增强密钥处理安全。
- 移除每会话 200 个子代理生成上限，同时修复了多个文件路径、插件安装和 Remote Control 相关漏洞。

## 全文

What's changed Added self-hosted environments: claude self-hosted-runner turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions can run, on Team and Enterprise plans Added archive plugin source: install plugins from a zip over HTTPS without git or npm, with optional SHA-256 pinning Added a cancel-and-confirm step when removing an unavailable paste changes a command's text Added ANTHROPIC_BEDROCK_REGION_PREFIX env var for Bedrock to prefer a specific cross-region inference profile over the AWS_REGION-derived one Added crossSessionInbound and dialogExpiry settings: cross-session messages sent to a session running with bypassed permissions are held for your approval, and messages to other sessions auto-deliver Added sandbox credential-masking options: extract and onExtractNoMatch for structured env values, decode: "jwt" with maskClaims for JWT-aware masking, and awsPairs/sigv4 for AWS SigV4 re-signing; these need network.tlsTerminate and are honored only from user, managed, or --settings settings Added cross-session SendMessage: Claude Code sessions can now message each other, on any of your machines, with ListAgents to discover them (macOS and Linux) Fixed long (>200 char) project paths resolving to another project's session directory under a shared sanitized prefix; session list, rename, fork, delete and /resume no longer cross projects Fixed SendMessage reporting "Message sent" when the write to a teammate's inbox had actually failed; failed deliveries are now reported as errors Fixed sandbox filesystem deny entries written with a trailing slash (e.g. denyRead: "~/.aws/") being silently bypassable on Linux and macOS Fixed sandbox violation details never appearing in Bash tool results; Claude now sees which file or network access was denied and why Fixed MCP tools that connect mid-turn being deferred for tool search without their names announced to the model Fixed plugin install records being silently corrupted when the same plugin is installed in multiple projects Fixed recalled or restored paste content occasionally attaching wrong data or silently losing text when the paste had aged out or placeholder numbers collided Fixed copy-on-select on Wayland sometimes not reaching the clipboard; the two selection writes no longer race Fixed the feedback survey's transcript share silently failing on long sessions; a failed share now shows an error instead of a success message Fixed Remote Control auto-start intermittently failing with "Remote credentials fetch failed" on a cold start with a stale login token Fixed Remote Control and SDK clients showing a blank "(no content)" message after /clear and other output-less commands Fixed a Remote Control session recreated after its server session expired uploading prior local conversation history into the new session Improved fullscreen mode to keep the full pre-compaction history in scrollback across repeated compactions, instead of only the most recent interval Improved Remote Control: attached web and mobile clients now see compaction progress and the post-compaction boundary instead of a silent pause; /clear resets now propagate to attached clients Improved Remote Control: connection failures now show a persistent failure indicator with details and a reconnect shortcut, instead of only an 8-second toast Removed the 200-subagent-per-session spawn cap; long-running sessions no longer refuse new agents (concurrency and depth limits still apply) Changed managed settings: the approval prompt no longer re-appears after re-login or org switching when the organization's settings are unchanged Changed the feedback-survey transcript share: with your consent it now also uploads the last request's model settings — the system prompt (which includes your CLAUDE.md instructions), tool definitions, and model parameters. Secrets are redacted as before, and these fields are dropped first if the share is too large Changed the Bash tool description to always note that command output is displayed to the model, not reliably to the user Changed recalled paste placeholder numbers to renumber when accepted into the input Changed Remote Control to archive the stale server session instead of leaving a dead one listed when a fresh session is minted after compaction or /resume [VSCode] Fixed the extension showing Remote Control as connected after the connection failed Fixed a session resume silently reconnecting Remote Control after the user turned it off (--resume, SDK hosts, and the VS Code extension) [VSCode] Fixed sessions not honoring remoteControlAtStartup when explicitly enabled

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_1d4c01b0fd7d59563cebdba8