Claude Code v2.1.222: Worktree Security, Proxy Fixes, and Usage Billing Rebalance

Claude Code v2.1.222 ships with a batch of security and reliability fixes. The headline: worktree-isolated sessions can no longer run destructive git commands against the main checkout, and auto-allow hooks no longer bypass tool restrictions in background tasks. There are also notable corrections to usage billing, proxy handling, and diff rendering.

Worktree and Background Agent Security

Previously, worktree-isolated sessions and their subagents could execute destructive git commands (like git reset --hard or git clean) against the main repository. Now, isolation properly applies to file edits and Bash in every session type. Additionally, PreToolUse auto-allow hooks were inadvertently bypassing tool restrictions in background agent tasks (summaries, compaction, renames) — that's fixed.

Proxy and Connectivity Fixes

The startup connectivity check was hanging and then failing behind HTTPS proxies. It now uses the same proxy-aware transport as API requests and times out with a clear message. Also fixed: 'Connection closed mid-response' errors were being reported on responses that had actually completed, causing false alarms.

Usage and Billing Corrections

Two important billing fixes:

• /usage-credits on Team and Enterprise no longer blocks users from sending a new request if a previous one was dismissed (previously it showed 'you've already sent a usage credit request').
• /usage overattributed usage to MCP servers. A server's share now reflects only the requests that actually consumed its tool results, instead of every turn after any call to it.

Other Targeted Fixes

• Sessions now correctly link to pull requests created after the branch was pushed, including via GitHub REST API.
• Org-restricted model aliases (like opus for subagents and teammates) no longer drop to the parent model; they step down to the newest org-allowed model in the family.
• Stream idle timeout no longer fires on custom ANTHROPIC_BASE_URL gateways when keep-alive pings are arriving.
• claude.ai connectors with invalid session tokens show a /login hint instead of falsely requiring authorization.
• Tool errors are displayed even for tools that are no longer available locally (e.g., after an MCP server is removed).
• SendMessage now truncates long summaries instead of rejecting them—sends no longer fail on character limits.
• The spinner's effort label in subagent transcripts now shows the subagent's own effort: setting, not the session's.
• Rare crashes from file watcher errors are fixed.
• Screen reader mode (--ax-screen-reader) now echoes only deleted characters on backspace instead of re-reading the whole line.
• Host model-selection keys take precedence over stale on-disk managed-settings.json when CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST is set.

Behavior and Feature Changes

• Auto mode safety: Messages sent to other agent sessions via SendMessage are now evaluated by the permission classifier before dispatch.
• Skill refusal: When Claude tries to invoke a skill with disable-model-invocation, it now asks you to run the skill instead of replicating its workflow.
• Diff rendering: /diff, Remote Control workspace diff, and file-edit diffs in web sessions now use raw git blob content, ignoring workspace diff drivers and textconv.
• Remote Control auto-start: Repo-local settings (.claude/settings.json or .claude/settings.local.json) can no longer turn it on (they can still turn it off); enable at user scope via /config.
• Ultraplan feature removed.

This release is primarily a bug-fix pass, but the worktree and proxy fixes are significant for teams using isolated environments and corporate proxies. If you're seeing ghost usage from MCP servers, this update corrects that too.