What probably matters to youSection of the release
What
The device-registration bridge validates its dial URL before connecting, so it cannot be pointed at an arbitrary websocket host.
Details
new isAllowedUrl check requires wss:, no username or password in the URL, and a hostname in {bridge.claudeusercontent.com, bridge-staging.claudeusercontent.com}
an operator-overridden base URL is allowed only through a separate same-origin check, which permits ws: only for localhost, 127.0.0.1 and [::1]
no such check existed in 2.1.224
the bridge only runs when non-essential egress is allowed, the provider is first-party, and the allow_remote_sessions policy permits it; the base URL is overridable via CLAUDE_REMOTE_TOOLS_BRIDGE_URL
Evidence
bridge-staging.claudeusercontent.com
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
