Image: GitHub / github.com/anthropics/claude-code Claude Code v2.1.221: Focus View, Two Security Patches, and 39 Changes
The latest Claude Code release adds a Focus view that hides tool noise behind per-turn summaries, fixes two permission-check bypass vulnerabilities in Bash and PowerShell, and adds sandboxed credential masking on Linux and WSL.
Claude Code v2.1.221 shipped on August 4, 2026, with 39 changes across new features, two security fixes, and a wide batch of bug fixes. The headline addition is a Focus view for VS Code. The more important changes are the security patches.
Focus view
The new Focus view is a toggle in the VS Code chat menu (or Ctrl+Alt+F) that hides tool execution details behind a collapsible per-turn summary. Instead of watching every file read and bash command scroll past, you see a compact summary with a live indicator for whatever’s currently running. You can still expand it if you want the full log.
This is a quality-of-life addition for long-running agent sessions where the tool output becomes more noise than signal.
Two security fixes
The more significant changes are the permission-check bypass patches.
Bash on zsh: Claude Code’s Bash tool was failing to catch commands hidden inside [[ ]] regex conditionals in zsh. A conditional like [[ "x" =~ $(malicious_command) ]] would execute the subshell without triggering a permission prompt, because the permission checker wasn’t parsing through that construct. Affected commands now correctly require approval.
PowerShell path handling: On Windows, paths containing quote characters weren’t being properly validated against the permission allowlist. A path like C:\my"path\file.txt could slip past checks that the real path would have required approval for. Those paths now trigger the approval flow.
Both of these affected users running in auto mode or with an allowlist, where the assumption is that unapproved commands don’t run without a prompt. If you’re on an older version and using either environment, updating is worth doing.
Sandbox credential masking
Claude Code 2.1.221 adds a mode: "mask" option for sandbox credential files on Linux and WSL. When masking is on, sandboxed commands see a sentinel (dummy) copy of the credential file. The sandbox proxy substitutes the real credential value on egress when actually needed. On macOS, this falls back to deny, which keeps the same security posture as before.
Other notable fixes
The MCP print mode fix is worth calling out. When running Claude Code with --mcp-config in print mode (-p), MCP servers weren’t connecting before the first turn. This broke batch automation and CI pipelines that rely on MCP tools from the first message. That’s now fixed.
A few other fixes that matter in practice:
- Files mentioned with @ were being silently dropped when you hit Escape to retract a prompt and resubmit. They’re now retained.
- The thinking toggle was effectively broken for sessions that started with thinking off. It now works correctly across the session.
- AWS SSO named profiles on Windows with a stray
HOMEenvironment variable were causing Bedrock authentication failures. - Vim mode yank register now survives dialogs, history searches, and transcript view.
- WebSearch was returning a 400 error at
xhigh/maxeffort when thinking was disabled. Fixed.
Behavioral changes
Background sessions now handle git more sensibly: they commit and push work, open draft PRs only when it makes sense, follow CLAUDE.md git instructions, and report where the deliverable lives.
Sessions created via /fork now get a dedicated worktree instead of sharing the original session’s checkout. This matters when you’re running parallel branches of a task.
The Gateway’s model field now rejects non-string values with HTTP 400 instead of silently forwarding them upstream.
The full changelog is on GitHub.