Claude Code v2.1.221: Masked Credentials, Focus View, and 20 Security Fixes

What Changed

Claude Code v2.1.221 is a hefty release packing security fixes, a new VSCode UI mode, and meaningful performance improvements. Here's the breakdown.

Sandbox Credential Masking (mode: "mask")

Linux and WSL users get a new sandbox mode for credential files. Instead of denying access entirely, mode: "mask" lets sandboxed commands read a sentinel copy of the file — either the whole file or just the spans captured by an extract regex — while the sandbox proxy substitutes the real value on egress. On macOS, file masking falls back to deny.

Why it matters: This closes the gap where sandboxed commands needed to read a credential file (like an AWS key) but you didn't want the model to see the raw secret. Now the model sees a masked placeholder, and the proxy swaps in the real value only when the command actually needs to send it out.

VSCode Focus View

A new chat-menu toggle hides tool activity behind an expandable per-turn summary with a live running-tool indicator. Toggle it with Ctrl+Alt+F or the "Claude Code: Toggle Focus view" command.

Why it matters: If you've ever felt overwhelmed by the wall of tool calls scrolling past in VSCode, this collapses them into a clean summary per turn. You see what happened, not every read_file and grep call. Click to expand when you need details.

Security Fixes

• Critical: Fixed a Bash permission-check bypass where zsh could execute hidden commands in [[ ]] regex conditionals. Affected commands now prompt for permission.
• Fixed PowerShell permission checks mishandling paths with quote characters on Windows.
• Fixed a crash when preparing API requests for SDK MCP tools named after built-in object properties like constructor.
• Fixed WebSearch failing with a 400 error at effort xhigh/max when thinking is disabled.

Performance & Workflow

• Reduced prompt-cache costs for auto-mode permission checks by reusing the cached conversation prefix across decisions.
• Improved Stats panel to count cache tokens (input, output, cache read, cache write breakdown).
• Fixed MCP servers from --mcp-config not connecting before the first turn in print mode (-p), which caused the model to emit tool calls as literal text.
• Fixed @-mentioned files being silently dropped when pressing Esc to retract a prompt and resubmitting.
• Fixed the thinking toggle having no effect for the rest of a session that started with thinking off.

Behavior Changes

• Background sessions now commit and push to preserve work, open a draft PR only when the task calls for one, follow your CLAUDE.md git instructions, and always report where the work lives.
• /fork sessions now create a new worktree instead of working in the original session's checkout.
• Plugins installed from /plugin activate immediately when safe, instead of always requiring /reload-plugins.
• /status now shows session kind: interactive, or a background job that's attached or unattended.
• claude plugin validate warns when a marketplace or plugin name would be rejected by Claude Desktop's managed marketplace sync.
• New prompt-audit subcommand in the claude-api skill for auditing prompts and tool descriptions written for older models.

What It Means For You

This release is a strong argument for updating immediately. The zsh permission bypass is the kind of thing that could let a malicious command slip through — update now.

If you're on Linux or WSL and use sandboxed commands with credentials, mode: "mask" is a workflow upgrade. Configure it in your settings file.

VSCode users should toggle Focus view on and see if it reduces noise. The live running-tool indicator alone is worth trying.

Try It Now

1. Update: claude update (or your package manager)
2. Enable Focus view in VSCode: Ctrl+Alt+F
3. Configure masked credentials (Linux/WSL):

   {
     "sandbox": {
       "files": {
         "/path/to/credentials": {
           "mode": "mask",
           "extract": "(api_key|token)\s*=\s*([^\n]+)"
         }
       }
     }
   }
   

4. Check your session kind: /status
5. Audit your prompts: claude-api prompt-audit

Source: github.com

[Updated 06 Aug via gh_claude_releases]

The release notes also detail several additional fixes not in the earlier summary. Notably, sandboxed large uploads no longer fail with TLS errors through the proxy, and Team/Enterprise spend-limit messages now correctly attribute limits to individual spend rather than the org's monthly cap [per GitHub]. Bedrock authentication with AWS SSO named profiles is fixed for Windows sessions with a stray HOME variable, and CLAUDE_CODE_RESUME_INTERRUPTED_TURN=0 now properly disables auto-resume. Vim mode yank registers survive dialogs and history search, and emoji autocomplete accepts alternate shortcodes like :thumbsup:. Windows startup no longer spawns PowerShell, avoiding endpoint security prompts.

[Updated 06 Aug via gh_claude_releases]

A follow-up patch, v2.1.223, addresses another Bash permission bypass where crafted commands could hide parts of themselves from checks, plus a related fix for prompts padded with tabs or invisible Unicode. It also closes a workflow sandbox escape via dynamic import() and enforces org bypass-permissions policies. Notably, CLAUDE_CODE_DISABLE_1M_CONTEXT now caps all native 1M-window models to 200K via auto-compaction, with a startup warning if enforcement fails. /review is now an alias of /code-review, which can target a PR with an effort level like ultra for deep cloud review [per GitHub].