Claude Code 2.1.221 ships VS Code's new Focus view, sandbox credential masking on Linux/WSL, and fixes two permission-check bypasses (hidden zsh commands in [[ ]] regex conditionals, and quoted Windows paths in PowerShell checks).
The Compliance API adds a new beta "remote sessions" endpoint group for retrieving Cowork session metadata and transcripts, with its own rate-limit budget and 6-year retention, documented across a dozen manage-claude pages.
A new AWS IAM action, ListComplianceActivities, authorizes the Compliance API's Activity Feed on Claude Platform on AWS.
The Agent Skills guide was substantially clarified: creating a new Skill version is a full snapshot (not a delta), uploads are capped at 30MB uncompressed, and Skill descriptions affect prompt-cache invalidation.
2.1.221 also fixes MCP servers from --mcp-config not connecting before the first turn in headless (-p) mode, and a crash preparing API requests for SDK MCP tools named after JS built-ins like constructor.
[VSCode] Added Focus view: a chat-menu toggle that hides tool activity behind an expandable per-turn summary with a live running-tool indicator, toggled with Ctrl+Alt+F or the "Claude Code: Toggle Focus view" command
Added mode: "mask" for sandbox credential files on Linux and WSL — sandboxed commands read a sentinel copy (the whole file, or just the spans captured by an extract regex) while the sandbox proxy substitutes the real value on egress; on macOS file masking falls back to deny
Added warnings to claude plugin validate when a marketplace or plugin name would be rejected by Claude Desktop's managed marketplace sync
Added a prompt-audit subcommand to the claude-api skill for auditing prompts and tool descriptions for patterns written for older models
Existing feature improvements
Improved tool search on Google Vertex AI: re-enabled for Claude 4.5-generation and newer models
Improved auto mode: permission checks for parallel tool calls are now cache-efficient, and switching modes while a check is pending reliably prompts instead of applying the stale result
Reduced prompt-cache costs for auto-mode permission checks by reusing the cached conversation prefix across decisions
Improved Stats panel to count cache tokens in its token totals, with a breakdown by input, output, cache read, and cache write
Improved /ultrareview error messages when a repo shares no history with its base
Improved Windows startup: process creation times are now read via a native kernel32 call instead of spawning PowerShell, so endpoint security tools that gate powershell.exe no longer prompt
Changed background sessions to commit and push to preserve work, open a draft PR only when the task calls for one, follow your CLAUDE.md git instructions, and always end by reporting where the work lives
Changed /plugin install to refresh a stale marketplace catalog and retry before reporting a plugin not found
Changed plugins installed from /plugin to activate immediately when safe, instead of always requiring /reload-plugins
Changed /status to show the session kind: interactive, or a background job that is attached or unattended
Changed sessions forked with /fork to create a new worktree of their own instead of working in the original session's checkout
Changed Claude in Chrome to close the browser tabs it opens once it no longer needs them
Changed fast mode to report on the stream when usage credits run out mid-session, instead of failing silently
Major bug fixes
Fixed a Bash tool permission-check bypass where zsh could execute hidden commands in [[ ]] regex conditionals; affected commands now prompt for permission
Fixed PowerShell permission checks mishandling paths containing quote characters on Windows; such paths now prompt for approval
Fixed the thinking toggle having no effect for the rest of a session that started with thinking off; disabling an MCP server mid-connect no longer silently reverts
Fixed MCP servers from --mcp-config not being connected before the first turn in print mode (-p), which made the model emit tool calls as literal text
Fixed @-mentioned files being silently dropped when pressing Esc to retract a prompt and resubmitting it
Fixed a crash when preparing API requests for SDK MCP tools named after built-in object properties such as constructor
Fixed WebSearch failing with a 400 error at effort xhigh/max when thinking is disabled
Fixed sandboxed large uploads failing with TLS errors through the sandbox proxy
Fixed Team and Enterprise spend-limit message incorrectly blaming the org's monthly limit instead of your individual spend limit
Fixed Bedrock authentication with AWS SSO named profiles failing in desktop-managed sessions on Windows machines that set a stray HOME environment variable
Fixed a rare wake-from-sleep race where two Claude Code processes could both refresh the same MCP connector or WIF OAuth token at once, forcing re-authentication
If a package manager doesn't honor npm's libc field (e.g., Yarn 1.x), both the glibc and musl native SDK packages get installed on Linux, roughly doubling install size; the SDK still launches the correct variant, and the docs now show how to delete the unneeded package to reclaim space in a container image. [line 7] [Source]
The "Needs input" row state now also covers a session waiting on an /install-github-app request. [line 96] [Source]
Claude Code now emits the pull-request badge as a hyperlink even when it can't detect terminal hyperlink support (e.g., over SSH or tmux); set FORCE_HYPERLINK=0 to render it as plain text instead. [line 126] [Source]
Claude Code won't background a session while you have unsent text in the prompt input, since that text can't move to the background session; typing while a background switch is pending cancels the switch with an explanatory message. [line 179] [Source]
Pressing Ctrl+X twice now deletes a session even if the stop attempt itself fails; a session whose worktree directory doesn't belong to any git repository can now also be deleted. [lines 195-203] [Source]
/fork's confirmation is now a single line naming the copy's state, row name, and session ID, and states where the copy runs: in its own new worktree, in the origin working tree, or in the current checkout. [lines 311-316] [Source]
When a backgrounded --agent session resumes or restarts, Claude Code now restores that agent's system prompt and tool restrictions; if the agent no longer exists, the session falls back to default tools/prompt with a warning in the transcript. [line 352] [Source]
The one-hour idle-process-stop behavior for finished, unattached sessions now explicitly also applies to a conversation you backgrounded with ← or /background and then left idle. [line 529] [Source]
If claude daemon stop can't verify the recorded supervisor process, the docs now explain how to recover: verify and stop the process yourself, then delete ~/.claude/daemon.lock so the next claude agents starts fresh. [line 625] [Source]
Version history note: with vim editor mode on, pressing ← on an empty prompt now opens agent view from NORMAL mode as well as INSERT (previously INSERT-only). [line 681] [Source]
Plan mode entry is now documented concretely: press Shift+Tab until the status bar shows ⏸ plan mode on, or start the session with claude --permission-mode plan. [line 52] [Source]
Switching out of plan mode is now documented as approving the plan or pressing Shift+Tab. [line 80] [Source]
The MCP server guidance now shows a concrete example: claude mcp add --transport http notion https://mcp.notion.com/mcp. [line 214] [Source]
The parallelization example now instructs Claude to save the generated file list to a file (e.g., files.txt) so a subsequent loop step can read it, rather than just listing the files. [line 464] [Source]
/heapdump is documented as not appearing in the command menu (must be typed in full), and guidance now says to attach only the -diagnostics.json file when reporting a memory issue. [line 70] [Source]
The requirements now specify Xcode 26.x is needed; the simulator pane doesn't yet work with Xcode 27, which replaces the Simulator app with Device Hub. [line 15] [Source]
New troubleshooting section: with Xcode 27 selected, attaching a device fails or simulators appear missing; shows how to select an Xcode 26.x install by path with xcode-select -s. [lines 114-124] [Source]
Claude Code now resends the session's fast mode status to devices connected through Remote Control after a model switch, a reconnection, or a failed availability check. [line 38] [Source]
New troubleshooting note: notify-send needs a desktop notification daemon that headless servers, SSH sessions, and most containers lack; install libnotify-bin on Debian/Ubuntu if it's missing. [lines 135-143] [Source]
New troubleshooting note for the Windows notification example: the command opens a dialog box that can appear behind your terminal window; powershell.exe must be on PATH when running Claude Code inside WSL. [lines 163-165] [Source]
Clarifies that a successful hook run shows nothing in the conversation; to confirm it ran, check its effect or use debug techniques. [line 208] [Source]
Non-blocking hook errors now show stderr prefixed with Failed with non-blocking status code: in the transcript, and the guide notes claude --debug or mid-session /debug to capture full stderr. [lines 559-560] [Source]
Debug techniques section rewritten to spell out what appears in the transcript for each outcome: nothing on success, stderr on a blocking error, and a <hook name> hook error notice on any other exit code. [lines 958-963] [Source]
Non-blocking hook exit codes now produce a stderr message prefixed with Failed with non-blocking status code: in the transcript, with a pointer to enable debug logging for the full stderr. [line 617] [Source]
Built-in subagents now inherit the parent conversation's permissions, but the docs clarify only "most" run with a restricted tool set, rather than all of them having additional tool restrictions. [line 21] [Source]
New "claude" catch-all subagent documented: it has every tool available to subagents and is used when a task doesn't fit a more specialized agent; it's also the default agent for a dispatched background session, running with your settings' permission mode rather than the parent conversation's. [lines 57-60] [Source]
Subagent delegation now shows in the transcript as a tool call row naming the subagent plus a short task description, e.g. code-improver (Suggest code improvements). [line 122] [Source]
Clarifies the x keybinding in the forks panel: it dismisses/stops only the selected fork row; on the main session row or an open fork's row, x types into the prompt instead. [line 906] [Source]
/compact returning Not enough messages to compact. is now documented: it means too few turns to summarize, which can happen even at full context if a single large paste filled it. [line 28] [Source]
/heapdump now writes two named files per session (<session-id>.heapsnapshot and <session-id>-diagnostics.json), doesn't appear in the command menu, and prints an in-conversation summary telling you whether to report the diagnostics file or investigate the heap snapshot yourself. [lines 33-43] [Source]
USE_BUILTIN_RIPGREP can now be set to 0 via the env block of settings.json, not just the shell environment. [lines 104-110] [Source]
Clarifies that an agent() call resolves to null if stopped mid-run or if it hits an unrecoverable API error, and pipeline() keeps that null in its results array — which is why the example code ends with .filter(Boolean). [line 276] [Source]
Claude Sonnet 5 is now listed as an available advisor model for the Haiku 4.5, Sonnet 4.6, Sonnet 5, and Opus 4.6 executor models, expanding the executor/advisor compatibility matrix for the advisor tool. [lines 638-641] [Source]
The read:compliance_user_data scope description now notes it also covers reading Cowork session transcripts, in addition to chats, files, projects, and users. [line 80] [Source]
Remote (Cowork) session transcripts retrieved through the Compliance API are now called out as retained for 6 years, the same as the Activity Feed. [line 19] [Source]
The IAM actions reference now documents a new ListComplianceActivities action (bringing the total from 65 to 66), which authorizes reading the Compliance API's Activity Feed; the route errors until the Compliance API is enabled for the organization, and the action is account-scoped, so specifying a workspace ARN has no effect. [lines 28-234] [Source]
The route-to-action mapping table adds GET /v1/compliance/activities mapped to ListComplianceActivities, classified as a Management event; compliance actions are now grouped with workspace actions as Management events since both are organization-scoped control-plane operations. [lines 254-291] [Source]
The List* wildcard in AnthropicReadOnlyAccess, AnthropicInferenceAccess, and AnthropicLimitedAccess now also grants ListComplianceActivities. [line 381] [Source]
The workspace-isolation policy example note now also calls out that the aws-external-anthropic:* wildcard's account-scoped actions include ListComplianceActivities, which the workspace ARN constraint silently filters out. [line 455] [Source]
The Compliance API availability note now specifies that access is authorized through the AWS IAM ListComplianceActivities action, rather than just "authorized through AWS IAM" generically. [line 384] [Source]
The CloudTrail monitoring section now states that compliance operations, alongside workspace, vault, and webhook operations, are logged as Management events by default. [line 554] [Source]
A new pagination row documents that remote sessions and session messages use a page-token scheme, with sessions returned newest-first and messages oldest-first by default. [line 91] [Source]
The remote session endpoints are called out as an exception to normal pagination behavior: they return next_page without has_more, so callers must stop when next_page is null. [line 95] [Source]
Compliance Access Keys now also grant access to Cowork remote sessions, alongside the existing chats, files, and projects coverage. [line 21] [Source]
Clarified that read:compliance_user_data can read Cowork session transcripts too, but delete:compliance_user_data only permanently deletes chats, files, and projects — sessions cannot be deleted. [lines 39-42] [Source]
The read:compliance_user_data scope table entry now explicitly includes reading Cowork remote sessions and their transcripts. [line 83] [Source]
Next-steps description clarifies that retrieval now includes Cowork session transcripts, while deletion remains limited to chats, files, and projects. [line 175] [Source]
The overview now states that Compliance API content access covers remote sessions in addition to chats, files, and projects. [line 7] [Source]
The content endpoints list now includes remote sessions, covering transcripts of Cowork sessions that run in Anthropic-managed cloud environments. [line 65] [Source]
Remote session endpoints now carry an additional request-rate budget on top of the shared 600 requests/minute limit. [line 67] [Source]
The content-retrieval section summary now mentions reading remote Cowork session transcripts, alongside chats and attachments. [line 97] [Source]
A new "Retrieve remote sessions" section documents two beta endpoints — GET /v1/compliance/apps/sessions/remote (list session metadata) and its /messages variant (retrieve a session's transcript) — both requiring read:compliance_user_data and counting against a separate rate-limit budget. [lines 279-285] [Source]
The list endpoint defaults to organization-wide scope, supports up to 500 organization_ids[] or 1-10 user_ids[] filters (filtering by user excludes agent-owned sessions), and supports created_at range filters, but has no updated_at filter. [line 287] [Source]
Sessions are sorted newest-first, capped at limit (default 100, max 500), and paginate with the same page-token scheme as projects/attachments, stopping when next_page is null. [line 341] [Source]
Documented the session ownership model: a session belongs to either a user or an agent (never both), with agent-owned sessions carrying agent_id and a started_by_user field identifying the human who triggered it. [line 343] [Source]
Documented session status values (pending, active, paused, archived, failed); pending sessions have no transcript yet and return 404 from the messages endpoint until provisioning completes. [line 345] [Source]
Documented the product_surface field (currently only cowork_remote) with guidance to build forward-compatible handlers that tolerate new status/product_surface values. [lines 347-351] [Source]
A new "Retrieve a session transcript" subsection documents the messages endpoint, whose response embeds a session envelope alongside the paginated message data. [line 421] [Source]
Messages are returned oldest-first by default (order=desc to reverse); a page can end early due to a response size budget, so a short page doesn't mean pagination is finished — callers must continue until next_page is null. [line 423] [Source]
Each message includes a role and content blocks (text, tool_use, tool_result); sent_by_user_id attributes agent-owned session messages to a user when known, and content_unavailable flags content that exceeded size bounds. [line 425] [Source]
New tool_use_input_max_bytes and tool_result_max_bytes parameters (default 10,000 bytes, -1 for the ~1 MiB server max) cap and can truncate large tool blocks; truncated tool_use inputs are no longer valid JSON. [line 427] [Source]
Remote session endpoints are read-only — sessions cannot be deleted through the Compliance API — and transcripts are retained for 6 years. [line 446] [Source]
The 404 retry guidance changed from a flat "No" to "Usually no": a remote session still in pending status now transiently 404s on its messages endpoint until it starts. [line 35] [Source]
The remote session transcript endpoint now enforces the same truncation-parameter validation as elsewhere: tool_use_input_max_bytes/tool_result_max_bytes must be a positive byte count or -1, otherwise a 400 is returned. [line 73] [Source]
Page-token pagination guidance now includes remote sessions and session messages, noting the stop condition there is next_page being null rather than has_more being false. [line 89] [Source]
A new "Remote session not found" error is documented: 404 occurs when a session ID doesn't exist, was deleted, belongs to an unreadable organization, or is still pending; a malformed session ID instead returns 400. [lines 252-262] [Source]
Remote session endpoints now carry a second, separate request-rate budget on top of the shared 600 requests/minute limit; a 429 from that budget includes retry-after but not the anthropic-ratelimit-* headers. [lines 316-354] [Source]
Three new FAQ topics were added under "Data coverage and retention": whether Cowork sessions appear in the Compliance API, what remote session transcripts include for Cowork, and how remote session coverage compares with Cowork's OpenTelemetry (OTEL) logging. [lines 25-29] [Source]
The shared 600-requests-per-minute Compliance API rate limit now has an additional carve-out: remote session endpoints carry an extra request budget on top of the shared limit. [line 28] [Source]
Content retention now spans four horizons instead of three: remote session transcripts are retained for 6 years by Anthropic, and organizations whose legal-hold/audit horizon exceeds that should export both Activity Feed pages and session transcripts to their own archive. [lines 116-129] [Source]
The Compliance API's content endpoints now also cover Cowork remote session transcripts, in addition to chats, files, projects, and project attachments. [line 145] [Source]
Remote session transcripts returned by the Compliance API exclude thinking blocks and images; they only carry user prompts, assistant responses, and tool activity. [line 148] [Source]
Claude Opus 5 (claude-opus-5) is now a supported model for the Dreams research preview, alongside the previously supported Fable 5, Opus 4.8, Opus 4.7, Sonnet 5, and Sonnet 4.6. [line 48] [Source]
A new "Next steps" link to the Authentication guide was added, describing how to compare API keys and Workload Identity Federation and set key expiration. [lines 150-152] [Source]
A new "Secure your credentials" step was added to the getting-started flow, advising you to set an expiration when creating an API key, keep keys out of source control/client-side code/prompts, and check whether Workload Identity Federation can replace a static key. [lines 46-50] [Source]
The agent-creation example now captures the returned ID into $AGENT_ID using --transform id --raw-output and echoes it, so it can be referenced in later steps. [lines 111-123] [Source]
The environment-creation example similarly now captures the returned ID into $ENVIRONMENT_ID and echoes it. [lines 135-145] [Source]
A new "Chat SDK quickstart" resource was added to Next steps, linking to a complete example app that pairs Managed Agents with Vercel's Chat SDK. [line 266] [Source]
New organizations with limited usage history are now specifically named as starting in the "Evaluation tier," rather than just described as starting with lower limits. [line 22] [Source]
New August 1, 2026 entry: Dreams (research preview) now supports Claude Opus 5. [line 17] [Source]
The July 24, 2026 entry now also notes that the Compliance API Activity Feed (GET /v1/compliance/activities) is available on Claude Platform on AWS, authorized by the new ListComplianceActivities IAM action. [line 120] [Source]
The files-api-2025-04-14 beta header is now documented as required only when you use the Files API to upload input files or download files a Skill produces, not for every Skills request. [line 62] [Source]
New note clarifies that Skills require the code execution tool, so the model used must come from the code execution tool's model compatibility list. [line 65] [Source]
Clarifies that the file_id for each file a Skill creates appears inside code-execution tool result blocks in the response, and adds guidance that input files for a Skill to work on should be uploaded via the Files API and referenced with a container upload block. [lines 105-109] [Source]
The 30 MB maximum Skill upload size is now specified as measured uncompressed. [line 359] [Source]
Clarifies that Skill files are copied into the container at /skills/{skill-name}/, using the Skill's name (not its skill_01... ID) as the directory. [line 500] [Source]
Documents that the response's container object carries the container's id and expires_at timestamp, which is what you reuse for multi-turn conversations. [line 186] [Source]
Clarifies that creating a new Skill version is a full snapshot, not a delta: you must re-upload the Skill's complete file set each time, and any files you omit are not carried over from the prior version. [line 440] [Source]
Notes that Skill version IDs are always strings, so epoch-timestamp version IDs must be quoted in JSON or YAML requests. Version management guidance expanded: pin a specific version for production, use latest for development. [lines 595-597] [Source]
Prompt caching guidance now explains that Skills render into the system prompt in a fixed order (so an identical Skills list produces a cache hit), and that pinning custom Skill versions helps avoid cache invalidation since publishing a new version under "latest" can change the Skill's description and invalidate the cached prefix. [lines 637-684] [Source]