Claude Code 2.1.222: worktree isolation actually holds now, ultraplan is gone

Claude Code 2.1.222 shipped on August 4, a day after 2.1.221. Two fixes go straight at session isolation and tool restriction enforcement, and one feature disappears outright. Here’s what matters.

Security: worktree isolation wasn’t actually isolating

The most serious fix in this release: worktree-isolated sessions, and their subagents, could run destructive git commands against the main checkout, reaching outside the sandbox that was supposed to contain them. Isolation wasn’t covering everything. It now applies to file edits and Bash, across every session type.

If you use isolation: 'worktree' (typically in a Workflow, to run agents in parallel without them stepping on each other), this closes a real gap: an isolated agent could previously touch the main repo through a git command, not just read or edit files outside its own worktree.

Security: background tasks could route around hooks

Second fix in the same vein: PreToolUse hooks configured with auto-allow could be bypassed during internal background tasks (summaries, compaction, session renames). Those system tasks were slipping past rules a hook was supposed to enforce. Fixed.

Along the same lines, messages sent to other agent sessions via SendMessage now go through the permission classifier before dispatch in auto mode, just like any other tool call.

Ultraplan is gone

No detail, no transition period mentioned in the changelog: the ultraplan feature has been removed. If it was part of your workflow, you’ll need to find another way, or check the official docs for an alternative.

Remote Control: repo settings can no longer turn it on by themselves

A behavior change worth knowing if you work on a shared repo: a .claude/settings.json or .claude/settings.local.json committed to a repo can no longer enable Remote Control on its own (it can still disable it). Turning it on now requires going through /config at the user level. That stops a settings file committed to a repo from silently switching Remote Control on for everyone who checks it out.

What changes your day-to-day

• /diff, the Remote Control workspace diff, and file-edit diffs in Claude Code on the web sessions now use raw git blob content, ignoring any diff drivers or textconv configured in the repo. If you were relying on textconv to make a binary or generated format readable in those views, it no longer applies.
• /usage no longer overattributes to MCP servers: a server’s share now reflects only the requests that actually consumed its tool results, instead of every turn following any call to it.
• Org-restricted model family aliases (a model: opus-style setting for a subagent or teammate) now step down to the newest org-allowed model in that family, instead of falling back to the parent model.
• /usage-credits no longer blocks a new request on Team and Enterprise for members whose earlier request was dismissed.

The rest, worth a skim

• Sessions weren’t linking to their pull request when it was created after the branch was pushed, including through the GitHub REST API: fixed.
• The startup connectivity check used to hang and then fail behind an HTTPS proxy: it now uses the same proxy-aware transport as API requests, with a clear timeout message.
• “Connection closed mid-response” errors were being reported on responses that had actually completed: fixed.
• Stream idle timeout firing on custom ANTHROPIC_BASE_URL gateways despite server keep-alive pings arriving on the wire: fixed.
• claude.ai connectors were falsely flagged as needing authorization when the actual problem was an invalid session token: it now shows a /login hint instead.
• SendMessage used to reject an overly long summary outright: it’s now truncated instead of failing the send.

Should you update

Yes, don’t wait, especially if you run workflows with worktree isolation or PreToolUse hooks set to auto-allow: both security fixes close real cases of bypassed isolation or restrictions, not theoretical ones. If you were using ultraplan, plan to do without it. Nothing else here justifies holding off.

Source: official Claude Code changelog.