Claude Code 2.1.222: worktree isolation escape fixed, ultraplan removed
Fixes two containment holes: worktree-isolated sessions and their subagents could run destructive git commands against the main checkout, and PreToolUse auto-allow hooks bypassed tool restrictions in background agent tasks. The ultraplan feature is removed, and repo-local settings can no longer enable Remote Control.
PUBLISHED2026-08-04
OBSERVED2026-08-11
AGE7d
SOURCES1
- Fixed worktree-isolated sessions and their subagents being able to run destructive git commands against the main checkout; isolation now covers file edits and Bash in every session type
- Fixed PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasks (summaries, compaction, renames)
- Removed the ultraplan feature
- Remote Control auto-start can no longer be turned on by repo-local settings (
.claude/settings.json/.claude/settings.local.json) — they can still turn it off; enable at user scope via/config - Auto mode now runs messages sent to other agent sessions via
SendMessagethrough the permission classifier before dispatch - Fixed
/usageoverattributing usage to MCP servers — a server's share now reflects only requests that consumed its tool results - Fixed org-restricted
model: opus-style subagent aliases dropping to the parent model instead of the newest org-allowed model in the family - Fixed the startup connectivity check and stream idle timeout misbehaving behind HTTPS proxies and custom
ANTHROPIC_BASE_URLgateways - Fixed
SendMessagerejecting a long summary; it now truncates instead of failing - Fixed claude.ai connectors being falsely marked as needing authorization when the session token is invalid — now shows a
/loginhint /diff, Remote Control workspace diffs, and web-session file-edit diffs now use raw git blob content, ignoring diff drivers and textconv
COMMUNITY
No curated reactions recorded for this event. Facts and takes are kept in separate layers — community context is added by hand, never blended into the record above.