Claude Code 2.1.224

Need Claude to work where your internal software, special hardware, or private data already live? Team and Enterprise users can run claude self-hosted-runner to make their own machine or container a place where Claude Code web, mobile, and desktop sessions run. Think of registering your workbench in a shared office: you can enter through different doors, while the actual work stays on the machine you prepared.

When your company gives you a plugin ZIP, you no longer need Git or npm first. The new archive plugin source installs a plugin from a ZIP over HTTPS and can pin its SHA-256 digest to check the downloaded file. It is like collecting a ticket at the box office: HTTPS is the collection window, and the SHA-256 digest is the ticket's security code that confirms it was not swapped.

When you restore pasted text in a command, you do not want the command itself quietly changed. If removing an unavailable paste would change that text, Claude Code now asks you to cancel or confirm. Recalled or restored paste content also avoids wrong attachments or lost text when it has aged out or placeholder numbers collide; accepted placeholders are renumbered. Like reviewing tracked changes before they are applied.

If your AWS account can use several regions, Bedrock no longer has to infer the cross-region inference profile solely from AWS_REGION. Set the new environment variable ANTHROPIC_BEDROCK_REGION_PREFIX to prefer a particular profile. It is like a navigation app that once looked only at your current city and can now be told which intercity route to prefer.

With one task on your desktop and another on your laptop, sessions can now find each other through ListAgents and exchange cross-session SendMessage messages on macOS and Linux. Messages sent into a session running with bypassed permissions can be held for your approval through crossSessionInbound and dialogExpiry; other sessions receive them automatically. A failed delivery now reports an error instead of pretending it succeeded. It is like office mail sorting: ordinary desks receive mail directly, while a workstation running with checks bypassed sends it to your approval tray first.

When Claude handles environment values containing credentials inside the sandbox, new masking options can extract structured values, handle no-match cases, or decode JWTs and hide chosen claims; awsPairs and sigv4 can re-sign AWS requests. They require network.tlsTerminate and only honor user, managed, or --settings settings. A trailing slash in denyRead: "~/.aws/" can no longer bypass a filesystem denial, and Bash results now tell Claude which file or network access was denied and why. It is like redacting account numbers from a document copy before sending it; a rejection slip then names the file or network request and the reason.

Remote Control, which attaches web or mobile to a Claude Code session, is less misleading around failures and resets. A cold start with a stale login token no longer intermittently fails; failures persist with details and a reconnect shortcut, and VS Code no longer claims a failed connection is live. /clear no longer creates a blank message and now reaches attached clients; they also see compaction progress and its boundary. Recreated server sessions do not upload prior local history, stale server sessions are archived, resuming does not secretly reconnect after you turned it off, and VS Code honors an explicit remoteControlAtStartup. Like a remote meeting room whose sign, whiteboard, and old recording all point to the right meeting.

After repeated compaction, which condenses earlier conversation to make room, fullscreen scrollback once kept only the most recent pre-compaction interval. Fullscreen now retains the full pre-compaction history across repeated compactions, so you can scroll all the way back. It is like an audio-recording timeline that preserves every segment: even after being organized many times, you can rewind to the earliest recording.

After signing in again or switching organizations, Claude Code will not ask for approval again when the managed settings are unchanged. It is not relaxing a new setting; it remembers that you already reviewed the same rules. Like a document with a new cover but unchanged contents: there is no need to sign the same consent form again.

After Claude runs a command, its output is displayed to the model but may not reliably be displayed to you. The Bash tool description now always states that distinction, so Claude does not confuse “I saw it” with “you saw it too.” Like a theater's backstage prompt script: the presenter sees the full content, but subtitles for the audience may not have caught up.