Claude Code v2.1.221-222: A Worktree Isolation Security Fix, Focus View, and Ultraplan's Quiet Exit

Two Claude Code releases landed back to back on August 3 and 4 — v2.1.221 and v2.1.222 — and between them is one fix worth pulling out from the usual long tail of bug patches: worktree isolation, one of the marquee safety features from April’s desktop redesign, had a real hole in it until this week.

The Worktree Isolation Fix

#

Git worktree isolation is the mechanism that lets Claude Code run a session in its own checkout so an agent’s file edits and commands can’t touch your main branch by accident. It’s a foundational trust boundary — the entire pitch of running multiple parallel agent sessions rests on each one being contained to its own worktree.

v2.1.222’s changelog entry is blunt about what was wrong: “Fixed worktree-isolated sessions and their subagents being able to run destructive git commands against the main checkout; isolation now applies to file edits and Bash in every session type.” Read literally, that means a subagent spawned inside an isolated worktree session could, under the right conditions, execute git commands that reached outside its own sandbox and mutated the checkout you were actually working in — the exact failure mode worktree isolation exists to prevent. There’s no CVE number attached and Anthropic hasn’t published a standalone advisory, but this is the kind of fix that belongs in the same conversation as the CLAUDE.md supply-chain issue (CVE-2026-21852) this blog covered back in April: a boundary that was assumed to hold, didn’t, quietly, until someone found it.

The same release closes a second, related gap: PreToolUse auto-allow hooks — the mechanism teams use to pre-approve specific tool calls — were bypassable inside background agent tasks like summaries, compaction, and renames, letting those background operations skip restrictions that would have applied to a normal foreground turn. And auto mode picked up a defense-in-depth improvement: messages sent between agent sessions via SendMessage now pass through the permission classifier before dispatch, instead of being treated as implicitly trusted just because they originated from another Claude Code session.

None of this is framed as an active-exploit disclosure — there’s no indication any of these were caught being used maliciously rather than found in testing — but for a tool that’s now handling parallel autonomous sessions across production codebases at scale, “isolation now applies to file edits and Bash in every session type” is exactly the kind of line that should make teams double-check they’re on v2.1.222 or later before running anything unattended.

What Else Shipped

#

v2.1.221 (August 3) was the larger feature release of the two:

• Focus view (VSCode only): a chat-menu toggle — Ctrl+Alt+F or the command palette — that collapses tool-call activity behind an expandable per-turn summary with a live running-tool indicator, aimed at the “wall of tool calls” problem that makes long agent sessions hard to read at a glance.
• Sandbox credential masking (Linux/WSL): a new mode: "mask" option for sandbox credential files. Instead of an all-or-nothing deny, sandboxed commands now read a sentinel copy of a credential file — either the whole thing or just the spans matched by an extract regex — while the sandbox proxy substitutes the real value only on the way out. macOS still falls back to deny since it lacks the same interception path.
• Two more permission-check bypasses closed: a zsh [[ ]] regex conditional could execute hidden commands past the Bash tool’s permission check, and PowerShell permission checks mishandled Windows paths containing quote characters. Both now correctly prompt for approval.
• Background sessions now commit and push automatically to preserve work, opening a draft PR only when the task actually calls for one, and always reporting back where the work ended up — a behavior change worth knowing about if your team relies on background/unattended sessions and hasn’t set branch protection accordingly.
• Vertex AI tool search re-enabled for Claude 4.5-generation models and newer, after apparently being disabled for that path.

Ultraplan Is Gone

#

Buried in v2.1.222’s changelog under a single line — “Removed ultraplan feature” — is the end of a feature this blog covered as its own launch back on April 11: /ultraplan, the command that spun up a dedicated planning session in Anthropic’s Cloud Container Runtime with up to 30 minutes of dedicated compute and three planning modes (Simple/Visual/Deep Plan). No deprecation notice, no migration guidance in the changelog, just gone. Given that /ultrareview (the review-side equivalent) survived this release and picked up its own error-message improvements, this reads less like Anthropic backing off cloud-hosted planning as a concept and more like a specific feature getting folded into or superseded by the broader Dynamic Workflows / Agent Teams primitives that have absorbed most of the multi-agent planning use cases since. Anthropic hasn’t said so explicitly, and there’s no successor command named in either changelog — worth watching for what, if anything, replaces the dedicated planning-session workflow /ultraplan provided.

The Takeaway

#

Neither release is a headline feature drop, and that’s arguably the point: this is what steady-state maintenance looks like for a tool that’s now load-bearing infrastructure for teams running autonomous agents against production code. The worktree isolation fix is the one to actually act on — check your version, update if you’re behind, and don’t treat “isolated” as a guarantee without it. Everything else is incremental polish, right down to a four-month-old planning feature getting quietly retired without ceremony.