# Claude Code 2.1.221: zsh permission bypass fixed, sandbox credential masking

> Fixes a Bash permission-check bypass where zsh could execute hidden commands inside `[[ ]]` regex conditionals, plus a Windows PowerShell path-quoting mishandling in permission checks. Adds credential masking for sandboxed commands on Linux/WSL and changes `/fork` to create its own worktree.

| | |
|---|---|
| **Tool** | Claude Code |
| **Version** | 2.1.221 |
| **Kind** | release |
| **Published** | 2026-08-03 |
| **Observed** | 2026-08-11 |
| **Significance** | 4/5 |
| **Breaking** | no |
| **Categories** | security, fix, feature |

## What changed


- Fixed a Bash tool permission-check bypass where zsh could execute hidden commands in `[[ ]]` regex conditionals; affected commands now prompt
- Fixed PowerShell permission checks mishandling paths containing quote characters on Windows; such paths now prompt for approval
- Added `mode: "mask"` for sandbox credential files on Linux and WSL — sandboxed commands read a sentinel copy while the sandbox proxy substitutes the real value on egress; on macOS file masking falls back to `deny`
- Sessions forked with `/fork` now create a new worktree of their own instead of working in the original session's checkout
- Plugins installed from `/plugin` now activate immediately when safe, instead of always requiring `/reload-plugins`; `/plugin install` refreshes a stale marketplace catalog and retries
- Plugins accept `"."` as a `skills` path; `claude plugin validate` warns on names Claude Desktop's managed marketplace sync would reject
- Background sessions now commit and push to preserve work, open a draft PR only when the task calls for one, and report where the work lives
- Fixed MCP servers from `--mcp-config` not connecting before the first turn in print mode (`-p`), which made the model emit tool calls as literal text
- Fixed `CLAUDE_CODE_RESUME_INTERRUPTED_TURN=0` not disabling interrupted-turn auto-resume
- Fixed WebSearch failing with a 400 at effort `xhigh`/`max` when thinking is disabled
- Re-enabled tool search on Google Vertex AI for Claude 4.5-generation and newer models
- Reduced prompt-cache costs for auto-mode permission checks by reusing the cached conversation prefix
- `/status` now shows session kind: `interactive`, or a background job that is `attached` or `unattended`
- [VSCode] Added Focus view (`Ctrl+Alt+F`) hiding tool activity behind an expandable per-turn summary


## Sources

- [changelog_md](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) — retrieved 2026-08-11

## Community

_No curated reactions recorded. Facts and community takes are kept in separate layers
and never blended._

---
Canonical: https://changelogs.info/claude-code/2-1-221
Entity: https://changelogs.info/claude-code
Event ID: `evt_2026-08-03_claude-code_2-1-221`
Licence: event synthesis © changelogs.info, CC BY 4.0. Linked sources belong to their vendors.