Release archive

Claude Code v2.1.224: Self-Hosted Environments, Cross-Session SendMessage, and Archive Plugin Sources

Claude Code v2.1.224 adds self-hosted environments via claude self-hosted-runner, cross-session SendMessage between your sessions, zip-based archive plugin sources, and more sandbox credential-masking options.

August 7, 2026 • 10 min read • By ClaudeWorld

Claude Code v2.1.224 is a broad release with 31 changelog entries. It introduces self-hosted environments on Team and Enterprise plans, lets Claude Code sessions message each other across your machines, adds an archive plugin source and new sandbox credential-masking options, and removes the 200-subagent-per-session spawn cap. Fixes include a sandbox deny-rule bypass, cross-project session directory collisions, and a series of Remote Control issues.

What’s New

Self-Hosted Environments

On Team and Enterprise plans, claude self-hosted-runner turns your own machines or containers into a place where Claude Code web, mobile, and desktop sessions can run.

Cross-Session SendMessage

Claude Code sessions can now message each other with SendMessage, on any of your machines, using ListAgents to discover them (macOS and Linux). The release also adds crossSessionInbound and dialogExpiry settings: cross-session messages sent to a session running with bypassed permissions are held for your approval, and messages to other sessions auto-deliver.

archive Plugin Source

The new archive plugin source installs plugins from a zip over HTTPS without git or npm, with optional SHA-256 pinning.

More Sandbox Credential-Masking Options

Sandbox credential masking gains extract and onExtractNoMatch for structured env values, decode: "jwt" with maskClaims for JWT-aware masking, and awsPairs/sigv4 for AWS SigV4 re-signing. These options need network.tlsTerminate and are honored only from user, managed, or --settings settings.

ANTHROPIC_BEDROCK_REGION_PREFIX for Bedrock

The new ANTHROPIC_BEDROCK_REGION_PREFIX env var lets Bedrock prefer a specific cross-region inference profile over the one derived from AWS_REGION.

200-Subagent Spawn Cap Removed

The 200-subagent-per-session spawn cap has been removed, so long-running sessions no longer refuse new agents. Concurrency and depth limits still apply.

Feedback Transcript Shares Include Model Settings

Sharing a transcript through the feedback survey now also uploads, with your consent, the last request’s model settings: the system prompt (which includes your CLAUDE.md instructions), tool definitions, and model parameters. Secrets are redacted as before, and these fields are dropped first if the share is too large. On long sessions, a failed share now shows an error instead of a success message.

Fixes and Improvements

Sandbox

  • Sandbox filesystem deny entries written with a trailing slash (e.g. denyRead: "~/.aws/") are no longer silently bypassable on Linux and macOS.
  • Sandbox violation details now appear in Bash tool results, so Claude sees which file or network access was denied and why.

Sessions

  • Long (>200 char) project paths no longer resolve to another project’s session directory under a shared sanitized prefix; session list, rename, fork, delete, and /resume no longer cross projects.
  • SendMessage no longer reports “Message sent” when the write to a teammate’s inbox had actually failed; failed deliveries are now reported as errors.
  • Fullscreen mode now keeps the full pre-compaction history in scrollback across repeated compactions, instead of only the most recent interval.

MCP and plugins

  • MCP tools that connect mid-turn are no longer deferred for tool search without their names being announced to the model.
  • Plugin install records are no longer silently corrupted when the same plugin is installed in multiple projects.

Paste and clipboard

  • A cancel-and-confirm step now appears when removing an unavailable paste changes a command’s text.
  • Recalled or restored paste content no longer occasionally attaches wrong data or silently loses text when the paste had aged out or placeholder numbers collided, and recalled paste placeholder numbers now renumber when accepted into the input.
  • Copy-on-select on Wayland no longer sometimes fails to reach the clipboard; the two selection writes no longer race.

Remote Control

  • Attached web and mobile clients now see compaction progress and the post-compaction boundary instead of a silent pause, and /clear resets now propagate to attached clients.
  • Connection failures now show a persistent failure indicator with details and a reconnect shortcut, instead of only an 8-second toast.
  • Auto-start no longer intermittently fails with “Remote credentials fetch failed” on a cold start with a stale login token.
  • A Remote Control session recreated after its server session expired no longer uploads prior local conversation history into the new session.
  • A session resume no longer silently reconnects Remote Control after you turned it off (--resume, SDK hosts, and the VS Code extension).

VS Code

  • The extension no longer shows Remote Control as connected after the connection failed.
  • Sessions now honor remoteControlAtStartup when it is explicitly enabled.

Managed settings and Bash

  • The managed-settings approval prompt no longer re-appears after re-login or org switching when the organization’s settings are unchanged.
  • The Bash tool description now always notes that command output is displayed to the model, not reliably to the user.

This release contains 31 changes in total; see the Claude Code changelog for the complete list.

How to Update

  1. Check your installed version: claude --version
  2. Update in place: claude update
  3. Be aware that sharing a transcript through the feedback survey now also uploads, with your consent, the last request’s system prompt (including your CLAUDE.md instructions), tool definitions, and model parameters.