Claude Code v2.1.221: Sandbox Credential Masking, a Bash Permission-Bypass Fix, and Silent Artifact Comment Threads#
Part of the Claude Code Version Tracker series. | Official Env Vars | Official Changelog
Coming from v2.1.219, a v2.1.221 user gets a closed security hole and a new way to keep secrets out of sandboxed commands. A Bash permission check could be bypassed when zsh ran hidden commands inside [[ ]] regex conditionals; those commands now prompt for approval.[1] Sandboxed commands can read credential files through a new mode: "mask": the sandbox hands the command a sentinel copy (the whole file, or just the spans an extract regex captures) and the proxy substitutes the real value only on egress, so the secret never sits in the sandbox filesystem. On macOS, where that masking is unavailable, the mode falls back to deny.
The VSCode extension adds a Focus view, a chat-menu toggle (Ctrl+Alt+F) that collapses tool activity behind an expandable per-turn summary with a live running-tool indicator. Plugins installed from /plugin now activate immediately when it is safe to do so instead of waiting for /reload-plugins; the binary wires this through activatePluginsAfterInstall, gated by tengu_plugin_install_auto_activate. /status reports the session kind: interactive, or a background job that is attached or unattended.
MCP connections got more resilient#
Several MCP fixes land together: servers from --mcp-config are connected before the first turn in print mode (-p) so the model no longer emits tool calls as literal text, disabling a server mid-connect no longer silently reverts, and a wake-from-sleep race where two processes refreshed the same connector or WIF token at once is closed. Underneath sits a new MCP_PROTOCOL_NEGOTIATION variable. Set to auto, Claude Code probes a server to negotiate a newer protocol revision and falls back to legacy when the client and server share no modern overlap; per-transport gates (tengu_mcp_protocol_negotiation_http, _stdio, _claudeai) let each channel roll out independently.
The unannounced part: artifact comment threads#
None of the following appears in the v2.1.221 changelog, and the two adjacent builds confirm where it landed: v2.1.220 added no environment variables or gates over v2.1.219, so the whole set below shipped in v2.1.221. Claude Code can publish a working prototype as a live artifact and then hold a conversation on it. The prompt text is explicit: "Build a working prototype as a published artifact first, or implement directly?" and "A human just activated you on a comment thread of an artifact you published." When activated, Claude reads and replies to comments, and with edit capability it can update the artifact itself in response to the thread.
| Variable | What It Does |
|---|---|
CLAUDE_CODE_ARTIFACT_COMMENTS | Turns on the artifact comment-thread capability, overriding the server gate tengu_teal_corbel. With it set, Claude reads and replies to human comments on an artifact it published, tracking each thread by slug and comment id. |
CLAUDE_CODE_ARTIFACT_COMMENTS_AUTOREACT | Overrides tengu_sorrel_trellis to let Claude respond to new comments on its own, driven by a task notification whose source is artifact-auto-react. The prompt text notes auto-replies do not re-enable on republish unless the user asks. |
CLAUDE_CODE_ARTIFACTS_API_TOKEN | Auth token for the artifacts service. The binary treats it as a credential alongside CLAUDE_CODE_OAUTH_TOKEN and ANTHROPIC_API_KEY, redacting it and using its presence to detect a configured account. Paired with CLAUDE_CODE_ARTIFACTS_API_BASE_URL and the asset/live base-URL knobs. |
MCP_PROTOCOL_NEGOTIATION | Accepts legacy or auto (anything else logs a warning and is ignored). In auto, Claude Code probes an MCP server to negotiate a modern protocol revision per transport, reverting to legacy when there is no shared version. |
Alongside the artifact variables, the org-memory path gained a write-consent step. When a durable project write is attempted, the code fires tengu_org_memory_write_opt_in_requested and asks before writing, recording ask_rejected on a 4xx and degrading silo selection rather than failing the turn. A prompt line states the grant can be approved from an interactive session.
What these tell us#
Two headline items keep the model's reach in check: the zsh [[ ]] bypass now prompts, and sandboxed commands read masked credentials that resolve to real values only at the network edge. The MCP work is a resilience pass, negotiating protocol versions, caching discovery, and closing a double-refresh race, so external tool connections survive more of what a long-lived session throws at them.
The artifact comment threads are the release's most complete unannounced feature: a full loop that publishes a prototype, receives a human comment as a task notification, then replies or edits the artifact, all behind two default-off gates with environment-variable overrides. It sits next to an org-memory change that now asks before a durable write. Both are collaboration surfaces put in place quietly, gated off, ahead of any changelog mention.
This analysis is conducted for educational and research purposes under fair use principles. All trademarks and software referenced belong to their respective owners. This content is not intended to infringe on any intellectual property rights, circumvent any protections, or encourage unauthorized access to proprietary systems.
Sources#
- Claude Code Official Changelog, v2.1.221 release notes
Related Versions#
- Claude Code v2.1.219: Opus 5 Becomes the Default Opus Model. New flagship, native 1M context, per-machine dispatch switch.
- Claude Code v2.1.218: Quieter Reviews, a Guard on Team Memory, and Two Knobs the Notes Skip. Review noise controls, memory write guard.
- Claude Code v2.1.217: Subagent Concurrency and Nesting Caps. Deeper agent trees, concurrency limits.
- CLAUDE_CODE_EXPERIMENTAL_OBSERVER_AGENTS: The Undocumented Observer Agents Flag. Background observer paired to an agent, shipped silently in v2.1.200.