# Claude Code 2.1.224: self-hosted runners and cross-session agent messaging

> Adds `claude self-hosted-runner`, letting Team and Enterprise plans run web, mobile, and desktop sessions on their own machines or containers, plus cross-session `SendMessage`/`ListAgents` so sessions on any of your machines can message each other. Also expands sandbox credential masking and changes what the feedback survey uploads.

| | |
|---|---|
| **Tool** | Claude Code |
| **Version** | 2.1.224 |
| **Kind** | release |
| **Published** | 2026-08-07 |
| **Observed** | 2026-08-11 |
| **Significance** | 4/5 |
| **Breaking** | no |
| **Categories** | feature, security, fix, api-change |

## What changed


- Added self-hosted environments: `claude self-hosted-runner` turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions can run (Team and Enterprise plans)
- Added cross-session `SendMessage` with `ListAgents` for discovery, across your machines (macOS and Linux); `crossSessionInbound` and `dialogExpiry` settings control approval of messages into bypassed-permission sessions
- Added an `archive` plugin source: install plugins from a zip over HTTPS without git or npm, with optional SHA-256 pinning
- Added sandbox credential-masking options — `extract`/`onExtractNoMatch` for structured env values, `decode: "jwt"` with `maskClaims`, and `awsPairs`/`sigv4` for AWS SigV4 re-signing; these require `network.tlsTerminate` and are honored only from user, managed, or `--settings` settings
- Privacy change: with your consent the feedback-survey transcript share now also uploads the last request's model settings — the system prompt (which includes your `CLAUDE.md`), tool definitions, and model parameters; secrets are redacted and these fields are dropped first if the share is too large
- Removed the 200-subagent-per-session spawn cap (concurrency and depth limits still apply)
- Added `ANTHROPIC_BEDROCK_REGION_PREFIX` to prefer a specific cross-region inference profile over the `AWS_REGION`-derived one
- Fixed long (>200 char) project paths resolving into another project's session directory under a shared sanitized prefix, which crossed projects on list, rename, fork, delete and `/resume`
- Fixed sandbox filesystem deny entries written with a trailing slash (e.g. `denyRead: "~/.aws/"`) being silently bypassable on Linux and macOS
- Fixed sandbox violation details never appearing in Bash tool results, so Claude now sees which access was denied and why
- Fixed `SendMessage` reporting "Message sent" when the write to a teammate's inbox had failed
- Fixed plugin install records being corrupted when the same plugin is installed in multiple projects
- Several Remote Control fixes: stale-token cold starts, blank "(no content)" after `/clear`, and a recreated session uploading prior local history into the new session


## Sources

- [changelog_md](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) — retrieved 2026-08-11

## Community

_No curated reactions recorded. Facts and community takes are kept in separate layers
and never blended._

---
Canonical: https://changelogs.info/claude-code/2-1-224
Entity: https://changelogs.info/claude-code
Event ID: `evt_2026-08-07_claude-code_2-1-224`
Licence: event synthesis © changelogs.info, CC BY 4.0. Linked sources belong to their vendors.