Claude Code 2.1.221: the Bash zsh permission bypass gets closed, background sessions start pushing on their own

Claude Code 2.1.221 shipped on August 4. Two permission fixes are genuine security matters, and background sessions change their default behavior in a way worth knowing about. Here’s what matters.

Security: a real permission bypass closed on Bash and PowerShell

The more serious of the two: on zsh, you could get hidden commands to execute inside [[ ]] regex conditionals, abusing regex matching to slip past the Bash tool’s permission dialog entirely. Those commands now prompt for approval like anything else.

A related fix lands on Windows: PowerShell permission checks mishandled paths containing quote characters, which could let a command through without a prompt. Those paths now require explicit approval too.

If you run Claude Code under zsh or PowerShell without constant supervision (CI, automation, a shared sandbox), these aren’t theoretical holes, they’re real gaps that just closed.

New: credential masking for sandboxed files

New mode: "mask" setting for sandbox credential files, on Linux and WSL. A sandboxed command reading a credentials file now sees only a sentinel copy (the whole file, or just the spans matched by an extract regex), while the sandbox proxy substitutes the real value at egress time. On macOS this falls back to deny for lack of an equivalent: the file simply stays inaccessible.

Useful when a sandboxed tool needs to believe a secrets file exists (checking for its presence before using it) without ever exposing the actual value to the model.

Background sessions now push their own work

A default-behavior change worth flagging if you run background tasks: they now commit and push their work to preserve it, open a draft pull request only when the task actually calls for one, follow the git instructions in your CLAUDE.md, and always end by reporting where the work ended up.

Before this release, a background session could finish its work without pushing it anywhere, which meant fetching it manually. If your current workflow relies on that silence (say, to review before any push happens), check your CLAUDE.md: it now drives the git policy these sessions follow.

What changes your day-to-day

/fork now creates a new worktree instead of continuing to work in the original session’s checkout. If you were forking a session to explore a side path without thinking about it, the two sessions no longer share a working directory.
Plugins installed via /plugin activate immediately when it’s safe to do so, without waiting for a manual /reload-plugins.
/plugin install refreshes a stale marketplace catalog and retries before reporting a plugin as not found.
/status now shows the session kind: interactive, or a background job that’s attached or unattended.
Claude in Chrome closes the tabs it opened once it no longer needs them, instead of leaving them around.
Fast mode: if usage credits run out mid-session, that now shows up in the stream instead of failing silently.
VS Code: new Focus view, which hides detailed tool activity behind an expandable per-turn summary with a live running-tool indicator. Toggle it with Ctrl+Alt+F or the “Claude Code: Toggle Focus view” command.

A bug that broke automation in print mode

Worth knowing if you script Claude Code: in print mode (-p), MCP servers passed via --mcp-config weren’t connected before the first turn. The model would then emit its tool calls as plain text instead of real tool calls, silently. That’s fixed now, but if a CI pipeline unknowingly depended on that broken default (say, parsing text output instead of waiting for a real tool call), its behavior is about to change.

Everything else worth knowing

WebSearch failing with a 400 error at effort xhigh or max when thinking was disabled: fixed.
The thinking toggle having no effect for the rest of a session that started with thinking off: fixed. Disabling an MCP server mid-connect no longer silently reverts either.
Sandboxed large uploads failing with TLS errors through the sandbox proxy: fixed.
@-mentioned files silently dropped when retracting a prompt with Esc and resubmitting it: fixed.
Team and Enterprise spend-limit messages wrongly blaming the org’s monthly limit instead of your individual spend limit: fixed.
Renaming a session from Claude Code Desktop or claude.ai wasn’t updating the CLI’s session name: fixed.
Stats panel: now counts cache tokens in its totals, broken down by input, output, cache read, and cache write.
Faster Windows startup: process creation times are now read via a native kernel32 call instead of spawning PowerShell, which also stopped some endpoint security tools from throwing up prompts.

Should you update

Yes, without hesitation, and sooner than usual if you run zsh or PowerShell: both permission fixes close a real bypass, not a theoretical one. Then check your CLAUDE.md if you run background sessions, their new default of committing and pushing automatically can catch you off guard if you were relying on the previous silence.

Source: official Claude Code changelog.