# Claude Code 2.1.222: worktree isolation escape fixed, ultraplan removed

> Fixes two containment holes: worktree-isolated sessions and their subagents could run destructive git commands against the main checkout, and PreToolUse auto-allow hooks bypassed tool restrictions in background agent tasks. The ultraplan feature is removed, and repo-local settings can no longer enable Remote Control.

| | |
|---|---|
| **Tool** | Claude Code |
| **Version** | 2.1.222 |
| **Kind** | release |
| **Published** | 2026-08-04 |
| **Observed** | 2026-08-11 |
| **Significance** | 4/5 |
| **Breaking** | yes |
| **Categories** | security, fix, breaking, deprecation |

## What changed


- Fixed worktree-isolated sessions and their subagents being able to run destructive git commands against the main checkout; isolation now covers file edits and Bash in every session type
- Fixed PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasks (summaries, compaction, renames)
- Removed the ultraplan feature
- Remote Control auto-start can no longer be turned on by repo-local settings (`.claude/settings.json` / `.claude/settings.local.json`) — they can still turn it off; enable at user scope via `/config`
- Auto mode now runs messages sent to other agent sessions via `SendMessage` through the permission classifier before dispatch
- Fixed `/usage` overattributing usage to MCP servers — a server's share now reflects only requests that consumed its tool results
- Fixed org-restricted `model: opus`-style subagent aliases dropping to the parent model instead of the newest org-allowed model in the family
- Fixed the startup connectivity check and stream idle timeout misbehaving behind HTTPS proxies and custom `ANTHROPIC_BASE_URL` gateways
- Fixed `SendMessage` rejecting a long summary; it now truncates instead of failing
- Fixed claude.ai connectors being falsely marked as needing authorization when the session token is invalid — now shows a `/login` hint
- `/diff`, Remote Control workspace diffs, and web-session file-edit diffs now use raw git blob content, ignoring diff drivers and textconv


## Sources

- [changelog_md](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) — retrieved 2026-08-11

## Community

_No curated reactions recorded. Facts and community takes are kept in separate layers
and never blended._

---
Canonical: https://changelogs.info/claude-code/2-1-222
Entity: https://changelogs.info/claude-code
Event ID: `evt_2026-08-04_claude-code_2-1-222`
Licence: event synthesis © changelogs.info, CC BY 4.0. Linked sources belong to their vendors.