Claude Code 2.1.224: Self-Hosted Runners, Cross-Session Messaging, and a Wave of Security Fixes
Claude Code 2.1.224 introduces self-hosted runners for Team and Enterprise plans, cross-session agent messaging on macOS and Linux, and a major cluster of sandbox and permission security fixes. Indian enterprise teams using Claude Code for compliance-sensitive workloads will find the credential-masking improvements and the removed 200-subagent cap particularly relevant.
Claude Code Gets Self-Hosted Runners and Inter-Agent Messaging in Version 2.1.224
Anthroptic’s Claude Code changelog for version 2.1.224 — published at code.claude.com — is one of the more consequential update logs the product has published. It spans new infrastructure capabilities, a significant set of security fixes, and a cluster of improvements to how Claude Code sessions talk to each other. If you use Claude Code on a Team or Enterprise plan, this update touches nearly every layer of how sessions run, how credentials are protected, and how agents coordinate.
Let’s unpack what actually changed and what it means for you as a non-technical professional using or evaluating Claude Code in an Indian work context.
What Is Self-Hosted Runners, and Why Does It Matter?
The headline addition in 2.1.224 is the claude self-hosted-runner command. According to the changelog, this turns your own machines or containers into a place where Claude Code web, mobile, and desktop sessions can run — available on Team and Enterprise plans.
In plain language: previously, when you used Claude Code through a browser or mobile app, the actual computation happened on Anthropic’s infrastructure. With self-hosted runners, your organisation can point Claude Code at its own servers or containers instead. The session still feels the same to you, but the work happens inside your own environment.
Why would a non-technical user care? Consider a mid-sized IT services firm in Pune whose security policy requires that code, prompts, and outputs never leave the company’s own data centre — a common requirement for teams working under DPDP Act compliance or client NDAs that prohibit cloud processing. Self-hosted runners directly address that constraint. The team’s developers can use Claude Code’s web or desktop interface, but every session executes on the firm’s internal servers rather than Anthropic’s cloud.
Cross-Session Messaging: Claude Agents That Talk to Each Other
A second significant addition is SendMessage and ListAgents — features that let Claude Code sessions message each other across any of your machines, on macOS and Linux. The changelog notes that crossSessionInbound and dialogExpiry settings control how these messages are handled: messages sent to a session running with bypassed permissions are held for your approval, while messages to other sessions auto-deliver.
Think of this as a coordination layer for multi-agent workflows. If you are running a content operations team at a digital media company in Hyderabad, you might have one Claude Code session monitoring incoming briefs, another drafting article outlines, and a third checking SEO keyword density. With cross-session messaging, these sessions can pass outputs to each other without a human manually copying text between windows.
The ListAgents command lets a session discover which other Claude Code sessions are running on your machines. The changelog is specific that this feature works on macOS and Linux — Windows users should note it is not listed as supported in this release.
Plugin Installation Without Git or npm
The new archive plugin source allows installing plugins from a ZIP file over HTTPS, with optional SHA-256 pinning for verification. This matters for organisations where developers cannot or do not want to depend on git or npm registries — again, a common scenario in enterprise environments with locked-down network policies.
If your IT team in Bengaluru manages a private plugin for internal tooling, they can now distribute it as a ZIP over your intranet rather than requiring a git server or npm registry to be reachable from every developer machine.
A Long List of Security Fixes You Should Know About
This release addresses several sandbox and permission vulnerabilities that are worth understanding even if you are not a developer.
The changelog describes a fix for a Bash tool permission-check bypass where a crafted command could hide parts of itself from permission checks. A separate fix addresses zsh executing hidden commands inside [[ ]] regex conditionals — affected commands now prompt for permission. Another fix resolves permission prompts being bypassable when commands were padded with tabs or invisible Unicode characters, which could have hidden part of a command from the approval dialog.
There is also a fix for sandbox filesystem deny entries written with a trailing slash (for example, denyRead: "~/.aws/") being silently bypassable on Linux and macOS. And a fix for workflow scripts being able to use dynamic import() to run code outside the workflow sandbox.
For a non-technical reader, the practical takeaway is this: several of these vulnerabilities could have allowed a malicious or poorly written tool to execute commands that bypassed the approval step that Claude Code shows you. These are now fixed. If your team uses Claude Code in any context where untrusted code or plugins are involved, updating to 2.1.224 is worth prioritising.
A Concrete Indian Scenario: A Finance Team in Chennai
Imagine a finance operations team at a Chennai-based NBFC using Claude Code’s web interface to automate parts of their loan processing workflow. They have connected Claude Code to internal databases via MCP servers. Analysts run background agents that pull data, summarise loan applications, and flag anomalies.
Before 2.1.224, several things could have gone quietly wrong: sandbox deny rules with trailing slashes could have been bypassed, letting agents read AWS credential directories they were not supposed to touch. Failed SendMessage deliveries silently reported success, so the team might never know a critical handoff between agents had failed. And the 200-subagent-per-session cap could have stalled long-running overnight batch jobs.
With 2.1.224, according to the changelog: the trailing-slash sandbox bypass is fixed, failed deliveries now report as errors rather than false successes, and the 200-subagent cap has been removed entirely (concurrency and depth limits still apply). For this team, those three fixes translate directly into more reliable overnight runs, better error visibility, and no more silent data-access boundary violations.
Limitations and Tradeoffs to Know
No update this large arrives without nuance. Here are the honest tradeoffs from the changelog:
- Self-hosted runners are Team and Enterprise only. If you are on a free or Pro plan, this feature does not apply to you.
- Cross-session
SendMessageandListAgentswork on macOS and Linux only. Windows is not listed as supported in this release. - Sandbox credential masking with
mode: "mask"is available on Linux and WSL. On macOS, file masking falls back to deny — a more restrictive but less flexible behaviour. - The
ANTHROPIC_BEDROCK_REGION_PREFIXenvironment variable for routing AWS Bedrock requests to specific cross-region inference profiles is a configuration option, not a guarantee of availability — actual cross-region inference profile availability depends on your AWS account and region setup. - The
ultraplanfeature has been removed in this release. If your workflow depended on it, you will need to find an alternative approach. - Feedback survey transcript sharing now also uploads model settings — including your system prompt (which contains your
CLAUDE.mdinstructions), tool definitions, and model parameters — when you consent. Secrets are redacted, and these fields are dropped first if the share is too large. This is worth understanding before you click consent on the survey. - The
/reviewcommand is now an alias of/code-review, and/code-review ultratriggers a deep cloud review. If your team had documented/reviewin internal guides, those references will still work, but the underlying command has changed.
What to Watch for Next
The volume and variety of fixes in 2.1.224 — spanning Bash permission bypasses, zsh regex conditionals, PowerShell path handling, MCP server connection timing, and Remote Control session state — suggests the Claude Code team is in an active hardening phase. The new Focus view in VS Code (a toggle that hides tool activity behind a per-turn summary) and the prompt-audit subcommand for the claude-api skill are early signals of usability improvements aimed at teams who find the raw tool-call output overwhelming.
If you are evaluating Claude Code for enterprise use in India, the self-hosted runner capability is the most significant infrastructure addition to track — it is the clearest path to running Claude Code within your own data boundary. Watch for documentation on how to set up and monitor self-hosted runners as Anthropic expands that feature set.
