Claude Code 2.1.228: Write changes its rule, synced skills get locked down

Claude Code 2.1.228 shipped on August 11. A good twenty changes, including one that touches a security habit you've probably taken for granted for months, plus a batch of hardening on synced skills. Here's what matters.

Write can now overwrite a file it never read

Up to now, a simple rule protected your files: the Edit and Write tools didn't behave the same way. Edit required reading a file in the current session before modifying it. Write had its own logic. As of 2.1.228, that's no longer true for recent models: Write now follows the same rule as Edit, and can overwrite an existing file it hasn't read this session. Older models keep the previous read-first requirement.

In practice, this aligns the two tools instead of adding a third behavior to track. But if you were relying on Write blocking without a prior read as a last-resort safety net, that's no longer the case on a recent model. Worth checking if you have hooks or scripts that depended on the behavioral gap between the two tools.

Synced skills: three hardening fixes against hijacking

Skills synced from claude.ai get a real security pass:

• They can no longer shadow a local command or MCP prompt sharing the same name (no more silent overriding).
• Their descriptions are sanitized and labeled, so you can tell at a glance that a skill came through sync rather than a local file you control.
• On your machine, their bodies can no longer run ! commands or expand @ file mentions.

That last point is the one that matters most: a malicious or compromised synced skill can no longer use its own content as a vector for command execution or local file exfiltration. It's the kind of fix that changes nothing about your day-to-day if everything was fine, but closes a real door.

Two more security fixes shipped in the same batch:

• Remote Control: resuming a conversation with /resume while connected could leak the resumed conversation's title or history into the connected session. Fixed.
• Settings marketplaces: a marketplace entry redefined in a higher-precedence settings tier could inherit another tier's custom headers instead of its own. Marketplace entries now merge as whole entries, not field by field.

A bug that could wipe your project's memory folder

Session cleanup could delete the contents inside a project's memory folder. If you've noticed notes or files vanishing from that folder over the past few weeks with no obvious cause, this is likely why. Fixed in 2.1.228.

The rest, worth a skim

• Windows: git and Git Bash stopped being found when Claude Code was launched from a parent folder of the git installation. Fixed.
• /tui: no longer reverts the session to an earlier model when /model had been changed since the last response.
• self-hosted-runner: a checkout hook failing on a repository the session doesn't push to no longer breaks every session on each fresh runner; that repository is now skipped with a warning. Also fixed: sessions no longer end in the gap between a background task finishing and the next turn starting.
• Cross-session messaging: the first run after install or upgrade no longer starts without an inbox.
• Plugin cache: background cleanup no longer deletes a plugin's cache when its only version is a symlinked development checkout.
• Vertex AI: expired or missing Google Cloud credentials now fail within seconds instead of retrying for minutes.
• Compaction: the retry countdown and stall hint now show up during compaction, not just a progress bar.
• Cross-session messages: sender and body now display inline instead of a collapsed line, and messages sent to a Remote Control session on another machine show your Remote Control session name as the sender.
• The deferred-tools reminder is no longer occasionally sent to the model twice after a skill invocation.
• Terminal-title spinner glyphs reworked to cut down on tab-bar jitter in some terminals.
• The outdated note about auto mode costing slightly more was removed from the first-use notice for Pro, Max, and Team plans.

Should you update

Yes. The synced-skills hardening and the Remote Control /resume leak fix are worth the update on their own if you use either feature. Add a deletion bug hitting project memory folders on top of that, and this update isn't optional this time.

Source: official Claude Code changelog.