Claude Discovery

← All discoveries

Close-up of wooden Scrabble tiles spelling SECURITY, symbolizing cybersecurity and protection.
Photo by Markus Winkler on Pexels
tool

Was Worktree Isolation Ever Actually Isolated Before 2.1.222?

2026-08-05 ยท source:

Claude Code 2.1.222 fixes worktree-isolated sessions and their subagents being able to run destructive git commands against the main checkout, extending isolation to file edits and Bash in every session type.

What it is

A patch release of Claude Code that closes a worktree isolation gap and a PreToolUse hook bypass, on top of a couple of account-management and connectivity fixes.

What it does

Worktree-isolated sessions and their subagents could previously still run destructive git commands against the main checkout rather than staying confined to their own worktree; this release extends isolation to cover file edits and Bash across every session type. It also fixes PreToolUse auto-allow hooks bypassing tool restrictions during background agent tasks like summaries, compaction, and renames.

Why it matters

Worktree isolation exists specifically so a background agent can't accidentally mutate the repo a human is actively working in, and this is the second fix in that area after v2.1.210's earlier worktree isolation bug fix, suggesting the isolation boundary has needed more than one pass to actually hold.

How to use it

Update to Claude Code 2.1.222 or later to get the corrected isolation behavior; no configuration change is needed to benefit from the fix.

Go to source →
claude-codesecuritygitsandbox
Related discoveries
Close-up of a smartphone wrapped in a chain with a padlock, symbolizing strong security.
tool

Claude Code 2.1.221 Masks Your Credentials Instead of Just Denying Them

Claude Code 2.1.221 adds a sandbox credential-masking mode that shows sandboxed commands a sentinel copy of a secrets file while a proxy swaps in the real value on egress, plus a VSCode Focus view that collapses tool activity.
Retro Apple computers with keyboards displayed in a Tokyo store window, showcasing early tech design.
tool

Claude Code 2.1.219 Makes Claude Opus 5 the Default Opus Model

Claude Code 2.1.219 makes Claude Opus 5 the default Opus model with 1M context and fast mode at $10/$50 per Mtok, and adds a sandbox.network.strictAllowlist setting to silently deny non-allowlisted hosts.
Close-up of a smartphone wrapped in a chain with a padlock, symbolizing strong security.
tool

Claude Code 2.1.214 closes a PowerShell permission bypass

Claude Code 2.1.214 fixes four permission-check bugs, including nested-directory allow rules matching too broadly and a bypass in Windows PowerShell 5.1 sessions.