Claude Code v2.1.222

Comment threads are now classified per comment into human, agent and unknown lanes, and sending or re-sending a comment to Claude is itself a trigger for auto-reply rather than only a new comment being one.

Thread listings sort threads with comments addressed to Claude first, and individual comments now report whether they were sent to Claude and whether they are still waiting on a reply.

Importing a skill from another agent now inspects the source directory and skips the copy with an explanation instead of producing a skill Claude Code cannot load.

When a side question falls back to a different model, the answer is now preceded by a warning banner naming the original and fallback models instead of silently switching.

Comment rows carry an explicit label when the comment was addressed to Claude, so it is clear which parts of a thread are a request to you and which are other people talking to each other.

The v2 remote-control transport now counts consecutive presence heartbeat failures and, when heartbeats keep failing while the SSE read stream still looks alive, closes with a new code 4093 and rebuilds the transport rather than sitting on a dead connection.

The v2 remote bridge can now detect the case where heartbeats keep failing while the SSE read stream is still delivering data, and tears the session down so the transport is rebuilt instead of sitting in a half-dead state.

In the MCP status UI, a server that is connected but whose discovery failed because the claude.ai session token was rejected gets its own line rather than the generic tools-fetch-failure line.

The thread renderer was replaced so the comments that actually caused this turn are never dropped to fit the budget.

Worktree plumbing no longer inherits ambient git environment variables, so a stray GIT_DIR or a repo fsmonitor cannot redirect worktree operations.

After creating a worktree, Claude Code checks that the new directory is acceptable as an isolation root and fails loudly if it is not.

Resuming a parked or isolated agent verifies the recorded worktree first and refuses rather than silently landing somewhere else.

A 403 from the plugin and skill search or list routes returns an empty result instead of surfacing an error, so an unentitled account sees nothing rather than a failure.

A subagent or teammate asking for a model that is not in availableModels now falls to the newest allowed model in the same family rather than straight to the parent or default model.

Transcript rows for messages arriving from another session render through a shared component that names the sender and offers an expand chord.

Detection of a newly created pull or merge request no longer depends on a single check right after the create command.

The tool for messaging another agent no longer auto-allows in every permission mode; in some modes it defers to classifier review.

The confirmation shown before importing a plugin or skill no longer talks about allowed-tools frontmatter, and instead spells out that bundled scripts and body instructions become active once imported.

When a subagent cannot get the model it asked for, the notify callback now carries a reason distinguishing a same-family step-down from inheriting the parent's model, and the message shown downstream differs accordingly.

Handling of the remote_control control request is now wrapped in a single async operation with its own error handling, and it hands off state to the newly created remote session instead of dropping it.

Many more git call sites now prepend the frozen safety arguments and run with an environment scrubbed of git overrides, closing off paths where inherited env vars could redirect a git command.

When the model tries to invoke a skill marked as user-only, the returned error now appends an explicit instruction against achieving the same thing another way.

When a turn falls back after a model refusal, the agent's displayed model is rewritten to the model actually used, and the fallback message now carries a scope.

The temp directory built to resume a stored session now copies settings.json and cowork_settings.json next to .claude.json, with plugin registration stripped.

Diff reads now pass --no-ext-diff and --no-textconv, so a repo's own git configuration cannot change the content Claude sees when computing patches.

Bash and shell execution paths now take an isolationRoot so the checks that keep agent commands inside their worktree have a concrete boundary to compare against.

The effort label in the status line is computed against the model actually running the turn, so it stays correct after a mid-turn model change or a fallback.

A refusal-driven model swap that happens inside a subagent or other non-main thread now surfaces a banner, where previously only main-thread swaps did.

A forbidden response when listing plugins fails fast instead of burning through the retry schedule, and the failure now reports which HTTP status caused it.

Recovery from 401, 4091 and 4093 transport closes is now table-driven, and repeated transport rebuilds are capped so a bridge that cannot heal stops retrying and says why.

The CCR v2 transport now spots heartbeats failing repeatedly while the SSE read stream still looks healthy, and closes the socket with code 4093 so the bridge rebuilds the transport instead of sitting on a half-dead connection.

Rather than guessing, auto-reply now defers when it cannot read who wrote a comment or whether it was sent to Claude.

The canned edit-failure replies were reworded to match the send-to-Claude mechanism instead of telling viewers to mention @claude.

The refusals you get when a shell cwd or file edit escapes a worktree now name the right subject.

Teardown now gives a pending remote-control operation time to finish before tearing down the rest of the session.

A WebSocket tunnel that never gets its protocol v2 negotiation acknowledged now fails fast instead of continuing in an undefined state.

The hello-endpoint probe used by the connection diagnostics now runs on fetch with an explicit timeout and reports whether a proxy was involved.

Fallback events now distinguish a session-wide model swap from a one-off fallback in a subagent or side question, so consumers can tell how far the change reaches.

Comment state now records when the server actually handed a comment to Claude, and the client uses that instead of local bookkeeping to decide what has already been shown.

Summary and failureReason text from teammates now passes through a trim-and-truncate helper before it reaches the teammate XML tag or the status line.

The Codex importer now refuses more source files before conversion instead of producing entries Claude Code would not load.

Three new refusal strings spell out why a command was not imported when its body mixes shell execution markers with argument placeholders.

The attestation notice emitter now keys on event_id and skips events it has already reported, so a single bad event no longer produces repeated warnings.

The lock guarding OAuth token refresh tolerates slower refreshes and lets the holder find out if its lock was taken away mid-flight.

In screen-reader mode the renderer can now erase trailing characters instead of repainting the line, cutting redundant output for assistive tech.

The web-ultraplan banner now says the plan is ready and tells you which key to press, replacing the older "Monitor progress in Claude Code on the web" wording.

The refusal shown when a git command would escape a worktree now derives the noun and possessive it uses rather than always saying "This agent" and "a worktree-isolated agent's".

Collapsed teammate status panels now show a generic label when no specific one is available, instead of rendering an empty descriptor.

Dated model ids that carry a 1m-context suffix are now reported verbatim in telemetry instead of being replaced with "nonconforming".

The watcher checks the error listener count before emitting, so a watch error or an error during a pending write can no longer surface as an unhandled 'error' event.

A permission response whose tool name does not match the pending request is now rejected with a warning instead of resolving the wrong tool call.

A new error class marks a resume that will never succeed, so the retry machinery gives up instead of looping.

The keep/restore-cwd path now detects a UNC or network-spelled original working directory and throws instead of changing into it.

The check for an outstanding admin request now looks only at pending requests.

An isolated agent whose worktree was deliberately removed no longer warns on resume that the worktree "is not recorded for this isolated agent". The removal is recorded in the agent's metadata instead of looking like missing state.

Leaving or cleaning up a worktree session now returns you to a directory resolved from a recorded anchor, rather than potentially failing when the original cwd is gone or unsafe.

A message whose summary is only whitespace is no longer treated as having a summary, so it renders in full instead of collapsing to an empty summarized form.

Stale MCP attribution no longer survives a conversation reset, so a later error or event is not tagged with the server and tool from a previous turn.

A refresh that loses the cross-process lock race is now reported as contention rather than as a failed refresh, and a compromised lock can still succeed.

Removing the last listener for a watched entry whose watcher never started no longer throws.

A thread that returns the same comment id twice no longer renders that comment twice.

Resolving the last pending permission or dialog request no longer unconditionally flips the session back to "running" when a park was preserved at shutdown.

The local tunnel now treats data arriving before HELLO_ACK as a protocol error and tears the socket down.

When an agent-proxy tunnel closes before a response arrives, the socket is now destroyed in all cases, removing a path where non-v2 connections could linger after a graceful end.

The import argument handling was rewritten into a parser plus a rewrite decision, but the command itself is not wired up here and prints a message instead of starting a session.

The control client can remember pending can_use_tool requests for a parked tool when the input stream closes, so they survive shutdown instead of being dropped.

The status footer computes an indicator element rendered in the "ide" color with a lozenge glyph, and the compact-footer width maths now reserves space for it. Whether it renders in this build could not be resolved.

Reading a foreign agent's Codex config during import now uses Bun's native TOML parser through a one-line wrapper, before the config is mapped.

The first-party event exporter gained a path that stores failed-event batches as append-only v5 streams keyed by run id and retries earlier runs in the background.

Several stores now have a v5 backend path sitting alongside the existing file path, taken only when a backend is supplied.

Transcript append, truncate and read helpers can now be pointed at a v5 storage backend instead of the filesystem, but only when a backend handle is passed in.

The parent-slice settings reader also derives a model overlay from the host-managed provider, and reports it as a source of truth.

The message converter no longer branches on a viewer-only mode, so tool-result behaviour is consistent for every caller.

Persisting an agent record no longer loses the worktree lineage fields that were set by an earlier write.

Failed heartbeat POSTs are no longer fire-and-forget; the client tracks a failure streak and reports it upward once it is long enough to matter.

The helper that pulls values like command, file_path, prompt and args out of tool input no longer trusts the shape of the object it is given.

Detached shell handoff accepts a root to re-anchor output files, so an adopting process can read outputs that would otherwise sit outside its tree.

Notification producers now hand back plain data instead of React elements, so the notification layer owns rendering.

Two marketplace entry fields no longer validate their shape, so malformed values now pass parsing instead of being coerced away.

The agent-workflow system prompt now substitutes the cap constant into the sentence describing how many items one parallel() or pipeline() call accepts, instead of hardcoding the number in prose.