Claude Code release notes: 2.1.224–2.1.225 give teams own runners and clearer spend limits

Claude Code 2.1.224 lets Team and Enterprise customers run cloud sessions from web, mobile, and desktop on their own runners. Version 2.1.225 makes operations easier to read with spend-limit warnings for gateway traffic, a trust prompt for claude agents, and clearer failures when a runner lacks a writable working directory.

Versions 2.1.223 through 2.1.226 have shipped since the previous Claude Code article. Version 2.1.223 closed gaps in Bash permissions and the workflow sandbox, among other fixes. Version 2.1.226 contains only general bug fixes and reliability improvements. The two changes most useful for teams to evaluate now are in 2.1.224 and 2.1.225: where the work runs and how users see spending limits.

Source: Claude Code 2.1.223 release notes.

Source: Claude Code 2.1.226 release notes.

Claude Code 2.1.224 can run cloud sessions inside your network

A self-hosted environment runs a Claude Code cloud session's tools and repository on infrastructure operated by the organization. A runner is the process that claims a job, clones the selected GitHub repository, and starts Claude Code on that host.

Source: Claude Code 2.1.224 release notes.

The feature is in public beta for Team and Enterprise and stays off until an Owner or admin enables it. Once configured, developers can select the environment for sessions started from Claude Code on the web, the mobile and desktop apps, scheduled routines, or the terminal with claude --cloud.

This gives sessions access to internal networks and a controlled runner image with the team's own compilers, SDKs, and CLIs. Anthropic does not need an inbound connection to the network. The runner polls the control plane over outbound HTTPS.

Source: Self-hosted environments in the Claude Code documentation.

This is not a fully local Claude deployment. Repository checkouts, build artifacts, secrets, and created files stay on the infrastructure you operate, but prompts, responses, and tool results go to api.anthropic.com for model inference. Anthropic also operates the control plane, queue, and session history.

2.1.225 makes runner and gateway operations easier to read

Claude Code 2.1.225 now shows the gateway's spend cap, reset time, and operator message in the user's usage warning, provided the gateway also runs 2.1.225. An LLM gateway is an intermediary that can manage model credentials, usage attribution, and spending limits for a team.

The same release adds a workspace trust prompt when claude agents opens in an untrusted directory. It also makes claude self-hosted-runner exit immediately with a clear error when --base-dir cannot be created or written. Two authentication issues are fixed as well: headless sessions could receive a stored login's short-lived token instead of their long-lived CLAUDE_CODE_OAUTH_TOKEN, and MCP OAuth on macOS could produce a burst of 401 errors after a keychain timeout. MCP, the Model Context Protocol, is the standard Claude uses to connect to external tools and data sources.

Source: Claude Code 2.1.225 release notes.

Source: LLM gateways in the Claude Code documentation.

Two operating choices that should stay separate

Self-hosted environments and gateway spend limits cover different parts of operations. The self-hosted environment decides where a session's tools run. A gateway controls separate Claude Code traffic configured to pass through it.

Anthropic's documentation says model inference in self-hosted environments cannot route through an LLM gateway, Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry. A team using both therefore needs two clear operating cards: one for cloud sessions on its own runners and one for gateway-routed CLI sessions. Do not mix their cost or network assumptions in the same test result.

Version 2.1.224 also lets Claude Code sessions on macOS and Linux send text messages to each other through ListAgents and SendMessage. Each receiving session keeps its own permissions, and messages sent to sessions that bypass normal permission prompts can be held for approval. This fits parallel worktrees where one session needs to report a change or test result to another without moving the full conversation.

Source: Cross-session messaging in the Claude Code documentation.

Try this prompt this week

Human step: An Owner or admin enables self-hosted environments for a Team or Enterprise organization. The operator uses Claude Code 2.1.225 or later, runs claude self-hosted-runner --help, chooses one bounded test repository, and gathers the runner configuration, writable --base-dir, Git access, and any gateway policy. Keep the environment secret out of chat.

Source: Claude Code self-hosted environments quickstart.

Read the runner docs, repository requirements, our Claude settings, and gateway policy.
Separate self-hosted cloud sessions from gateway-routed CLI traffic.
Propose one read-only test using one repository and a clear stop point.
List the network paths, Git access, base directory, and approvals it needs.
Name the evidence to retain: runner health, commit, environment, spend warning, and failures.
Change nothing. Return a short run receipt and mark it as not yet verified.

Good output should:

• keep the two operating architectures separate,
• point to real settings and sources instead of guessing,
• name an owner, stop point, and evidence for each check,
• tie the gateway spend limit only to traffic that actually uses the gateway.

This is a natural Tool Forge task: connect a runner to the right repository and internal tools, give it scoped permissions, and make every run reviewable before adding more sessions.