Claude Code
- Write tool behavior changed for newer models. Overwriting an existing file no longer requires reading it first, matching Edit's existing rules; older models still require the read.
- Cloud-synced skills hardened against shadowing and injection (more below). Skills from claude.ai can no longer shadow local slash commands or MCP prompts, and on your machine their bodies won't run
!commands or expand@file references. /tuino longer silently reverts your/modelchoice. If you changed models mid-session,/tuiwas resetting to the model the session started with.- Session cleanup was deleting your project memory folder contents. If
.claude/memory/files vanished during cleanup, this was the cause.
New in 2.1.228
2.1.228 (August 12, 2026)
- Fixed interactive sessions that could stop redrawing entirely, while the process kept running, after a rare internal layout error
- Fixed
git/ Git Bash not being found on Windows when Claude Code is launched from a parent folder of the git installation - Fixed
/tuireverting the session to an earlier model when/modelhad been changed since the last response - Fixed cross-session messaging sometimes starting without an inbox in the first session after install or upgrade
- Fixed Remote Control
/resumewhile connected leaking the resumed conversation's title or history into the connected session - Fixed
claude self-hosted-runnersessions failing on every fresh runner when thecheckouthook fails for a repository the session doesn't push to; that repository is now skipped with a warning - Fixed self-hosted runners ending sessions in the gap between a background task finishing and the follow-up turn starting
- Fixed session cleanup deleting contents inside a project's memory folder
- Fixed background plugin-cache cleanup deleting a plugin's cache when its only version is a symlinked development checkout
- Fixed a settings-merge issue where a marketplace entry redefined in a higher-precedence settings tier could inherit another tier's custom headers; marketplace entries now merge as whole entries
- Fixed the deferred-tools reminder occasionally being sent to the model twice after a skill invocation
- Hardened skills synced from claude.ai: they no longer shadow local commands or MCP prompts, their descriptions are sanitized and labeled, and on your machine their bodies don't run
!commands or expand@files - Improved cross-session messages: the sender and body now display inline instead of a collapsed line, and messages to Remote Control sessions on other machines show your Remote Control session name as the sender
- Improved Vertex AI credential handling: expired or missing Google Cloud credentials now fail within seconds instead of retrying for minutes
- Improved compaction progress: the retry countdown and stall hint now appear during compaction instead of only a progress bar
- Updated terminal title busy-spinner glyphs to reduce tab-bar jitter on some terminals
- Changed the Write tool so newer models can overwrite an existing file they haven't read this session, matching the Edit tool's rules; older models still require the read first
- Removed the outdated note about auto mode sessions costing slightly more from the first-use notice for Pro, Max, and Team plans
Notes
Security hardening arc continues
The skills hardening in 2.1.228 is the third beat of a permission-tightening arc. 2.1.221 closed a Bash bypass where zsh [[ ]] regex conditionals could hide executable commands. 2.1.223 followed with broader Bash permission-check hardening and workflow sandbox fixes. This release extends the surface to cloud-synced skills, closing a vector where a skill synced from claude.ai could shadow a local /command or inject shell commands via ! syntax. If you maintain custom skills or MCP prompts with names that might collide with cloud-synced ones, the collision is now resolved in your favor.