release aidev SIG 4/5

Claude Code 2.1.224: self-hosted runners and cross-session agent messaging

Adds claude self-hosted-runner, letting Team and Enterprise plans run web, mobile, and desktop sessions on their own machines or containers, plus cross-session SendMessage/ListAgents so sessions on any of your machines can message each other. Also expands sandbox credential masking and changes what the feedback survey uploads.

PUBLISHED2026-08-07
OBSERVED2026-08-11
AGE4d
SOURCES1
  • Added self-hosted environments: claude self-hosted-runner turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions can run (Team and Enterprise plans)
  • Added cross-session SendMessage with ListAgents for discovery, across your machines (macOS and Linux); crossSessionInbound and dialogExpiry settings control approval of messages into bypassed-permission sessions
  • Added an archive plugin source: install plugins from a zip over HTTPS without git or npm, with optional SHA-256 pinning
  • Added sandbox credential-masking options — extract/onExtractNoMatch for structured env values, decode: "jwt" with maskClaims, and awsPairs/sigv4 for AWS SigV4 re-signing; these require network.tlsTerminate and are honored only from user, managed, or --settings settings
  • Privacy change: with your consent the feedback-survey transcript share now also uploads the last request's model settings — the system prompt (which includes your CLAUDE.md), tool definitions, and model parameters; secrets are redacted and these fields are dropped first if the share is too large
  • Removed the 200-subagent-per-session spawn cap (concurrency and depth limits still apply)
  • Added ANTHROPIC_BEDROCK_REGION_PREFIX to prefer a specific cross-region inference profile over the AWS_REGION-derived one
  • Fixed long (>200 char) project paths resolving into another project's session directory under a shared sanitized prefix, which crossed projects on list, rename, fork, delete and /resume
  • Fixed sandbox filesystem deny entries written with a trailing slash (e.g. denyRead: "~/.aws/") being silently bypassable on Linux and macOS
  • Fixed sandbox violation details never appearing in Bash tool results, so Claude now sees which access was denied and why
  • Fixed SendMessage reporting "Message sent" when the write to a teammate's inbox had failed
  • Fixed plugin install records being corrupted when the same plugin is installed in multiple projects
  • Several Remote Control fixes: stale-token cold starts, blank "(no content)" after /clear, and a recreated session uploading prior local history into the new session
featuresecurityfixapi-change

COMMUNITY

No curated reactions recorded for this event. Facts and takes are kept in separate layers — community context is added by hand, never blended into the record above.