Claude Code release notes: 2.1.221–2.1.222 mask secrets and isolate worktrees

Claude Code shipped two versions after Hammer's previous review. Version 2.1.221 adds credential-file masking for sandboxed commands on Linux and WSL. Version 2.1.222 then closes two boundaries for background agents: worktree isolation and PreToolUse hooks.

Teams that let Claude Code work in parallel against real codebases get two useful changes. The agent can use functioning tools without placing raw credentials in its working environment. Its changes also stay away from the main checkout until a human reviews them.

Source: Claude Code 2.1.221 on GitHub.

Source: Claude Code 2.1.222 on GitHub.

Source: Current Claude Code version in the npm registry.

Claude Code release notes: authentication that works without exposed secrets

A sandbox is a bounded runtime that restricts which files and network addresses a command can use. In 2.1.221, a credential file can use mode: "mask" on Linux and WSL. The command reads a copy in which the real secret has been replaced by a sentinel. The sandbox proxy restores the value only in an outbound request to an allowed host.

Tools such as gh, npm, or cloud clients can still authenticate, but the agent process and its logs do not need to hold the real value. For file-based credentials on macOS, mask falls back to deny, so the tool cannot read the file and no substitution occurs.

Masking must be configured at user, managed, or CLI scope. Repository settings cannot turn it on. Hosts should be narrowly scoped, and TLS termination must be configured, so the proxy can substitute the sentinel inside the encrypted request.

Source: Anthropic's documentation on sandboxing and credential-file masking.

2.1.222 closes worktree and hook gaps for background agents

A Git worktree is a separate working directory attached to the same repository. It lets a background agent work on its own branch without mixing files into the main checkout. Version 2.1.221 also changed /fork so the new session gets its own worktree. Background sessions should preserve work with a commit and push, open a draft pull request only when the task calls for one, and always report where the work lives.

Version 2.1.222 fixes a bug that let worktree-isolated sessions and their subagents run destructive Git commands against the main checkout. Isolation now covers file edits and Bash in every session type. The same release fixes a bug where auto-allowing PreToolUse hooks could bypass tool restrictions in some background tasks. A hook is a rule or script that runs at a defined event, such as before a tool is used.

You still need merge review and an approval gate before deployment. Worktrees, hooks, and diffs now provide better evidence for that review.

Source: Claude Code 2.1.221 changelog.

Source: Claude Code 2.1.222 changelog.

Use the update in a real workflow

Choose a background task that already has a clear end state, such as updating tests on a dedicated branch. Give the agent the access it needs through a secret manager or masked credential file, scoped hosts, and the write permissions required by the task. Keep human approval for merges, releases, and other irreversible steps.

After the run, your team should be able to answer four questions: which worktree was used, which files changed, which rules blocked disallowed actions, and where is the commit or pull request? If answering requires a hunt through several logs, the workflow still needs work.

Try this prompt this week

Human step: Update Claude Code through your normal installation method and confirm that it reports version 2.1.222. Open a test repository, run /sandbox to view the active configuration, and collect CLAUDE.md, relevant .claude/settings*.json files, hook configuration, and current Git status. Do not run the test task yet.

Source: Anthropic's steps for opening and checking the sandbox.

Read CLAUDE.md, the Claude Code settings, hooks, and current Git/worktree state.
Map what a background agent may read, edit, run, commit, and push.
Check credential rules and flag the Linux/WSL versus macOS behavior.
Propose a test that proves the main checkout stays unchanged and PreToolUse rules hold.
Name the evidence to save: worktree path, diff, blocked actions, and commit or PR target.
Change nothing yet. Return the plan, missing settings, and explicit approval points.

Good output should:

• Name exact files, setting scopes, and unclear permissions.
• Give the test unambiguous pass and fail conditions.
• Separate the agent's work from the human update, merge, and deployment decisions.
• Leave a short run receipt that another reviewer can understand.

When several teams need the same pattern, Tool Forge can make permissions, authentication, and run receipts a managed part of the integration.