v2.1.224

Source: Anthropic Claude Code Date: 2026-08-07 URL: https://github.com/anthropics/claude-code/releases/tag/v2.1.224

Summary

Claude Code 2.1.224 adds a self-hosted-runner mode (Team/Enterprise plans can point web, mobile, and desktop sessions at their own machines or containers), an archive plugin source for installing plugins from a zip over HTTPS with optional SHA-256 pinning (no git/npm required), and cross-session SendMessage/ListAgents so Claude Code sessions can message each other across machines. It also fixes several sandbox and Remote Control bugs, including sandbox deny-paths with trailing slashes being silently bypassable and violation details never surfacing in Bash tool results.

Implications

Feeds the agent extension supply-chain thread directly: the zip-over-HTTPS archive source with SHA-256 pinning is the same distribution-widening-while-trust-narrowing move flagged in the 08-07 report (portable delivery paired with an integrity pin), landing in the same release as cross-session messaging — another expansion of what one Claude Code session can reach and act on.

• The sandbox trailing-slash bypass fix and the “violations never surfaced” fix matter for the hold-less / distrust-descends thread: they’re closing gaps in the exact isolation boundary that autonomous/bypassed-permission sessions rely on.
• Self-hosted runners plus cross-session SendMessage compound: agents can now both run on infrastructure the user controls and coordinate with each other across machines — worth watching as a precursor to more autonomous multi-agent topologies.