Claude Code v2.1.222: Worktree Isolation Now Blocks Destructive Git in Every Session#

Part of the Claude Code Version Tracker series. | Official Env Vars | Official Changelog

Coming from v2.1.221, a v2.1.222 user gets a worktree-isolated session that can no longer reach past its own checkout. Before this release, a session running in an isolated worktree, and its subagents, could still run destructive git commands against the main checkout. Now the isolation boundary covers file edits and Bash in every session type.[1] A second security fix stops PreToolUse auto-allow hooks from bypassing tool restrictions inside background agent tasks (summaries, compaction, renames).[1]

The worktree change is the largest in the binary. Resume now revalidates the recorded worktree before entering it, tagged through tengu_worktree_resume_root_rejected with explicit reason codes: worktree-gone when the directory is missing, network-spelled-pin when the recorded path can never be a local isolation root, and unverifiable when git cannot answer right now. A rejection either clears the binding or keeps it for a later --resume to retry, and the user sees plain guidance ("Recreate the worktree with git worktree add, then retry", "The worktree binding is kept and a later --resume will retry it"). Creating a worktree is guarded the same way: git_worktree_create_root_rejected refuses a directory that belongs to a different repository. Two new checks, declineSelfOwningPinUnderLiveRoot and requireWitnessForSelfOwningPins, keep a session from pinning itself as its own isolation root.

Connection and streaming fixes#

Several long-standing connection annoyances close here. The startup connectivity check used to hang and then fail behind an HTTPS proxy; it now runs through the same proxy-aware transport as API requests and times out with a clear message.[1] "Connection closed mid-response" was being reported on responses that had actually finished. A new gate, tengu_streaming_close_after_complete, tells a close that arrives after end_turn apart from a genuine mid-stream failure, so a completed turn no longer shows an error.[1] Stream idle timeouts also stop firing on custom ANTHROPIC_BASE_URL gateways that send server keep-alive pings.[1]

SendMessage gets two fixes. A long summary is now truncated instead of rejected, so a send no longer fails on a character limit, and in auto mode a message to another agent session is run through the permission classifier before dispatch (the binary carries the copy "Message to another agent requires classifier review" next to isAutoClassifierActive).[1]

Model routing and connector auth#

Org-restricted model: opus-style aliases for subagents and teammates were dropping straight to the parent model. They now step down to the newest org-allowed model in the family, wired through family_step_down and getPairedPolicyModelOverrides.[1] Host model-selection keys also take precedence over a stale on-disk managed-settings.json when CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is set.[1] And a claude.ai connector with an invalid session token is no longer mislabeled as needing authorization; the claudeai_bearer_rejected path now shows a /login hint instead.[1]

Two accounting fixes round out the release. /usage no longer overattributes usage to an MCP server for every turn after any call to it, so a server's share reflects only the requests that consumed its tool results, and /usage-credits stops telling Team and Enterprise members with a dismissed request that they have already sent one.[1] The ultraplan feature is removed.[1]

What these tell us#

The release reads as a hardening pass on the boundaries a session is supposed to respect. Worktree isolation, the PreToolUse fix, and the SendMessage classifier check all close paths where an agent or a background task could act outside its lane, and the reason codes threaded through the worktree resume path show the isolation logic being made auditable rather than best-effort.

The rest is connection durability. Beyond the streaming and proxy fixes, the binary carries a remote-bridge self-heal gate, tengu_bridge_selfheal_heartbeats, that feeds a heartbeat recovery ladder (heartbeat_4093_recovery, recovery_connect_timeout, refresh_connect_timeout) into the v2 remote transport, and tengu_auq_park_preserved_at_shutdown, which keeps a parked AskUserQuestion answerable across a stream close instead of cancelling it. Neither is named in the changelog; both point at the same goal as the fixes that are, keeping a long-lived or remote session working through the interruptions it will hit.

This analysis is conducted for educational and research purposes under fair use principles. All trademarks and software referenced belong to their respective owners. This content is not intended to infringe on any intellectual property rights, circumvent any protections, or encourage unauthorized access to proprietary systems.

Sources#

  1. Claude Code Official Changelog, v2.1.222 release notes

Let's Connect

BlueskyLinkedInThreads
← Back to all posts