Claude Code v2.1.221 patches a Bash tool permission-check bypass where zsh could execute hidden commands inside [[ ]] regex conditionals without prompting. The fix is the headline item in a release that also adds a Focus view for VSCode and credential masking for Linux sandboxes.
What changed:
- Focus view (VSCode) — A chat-menu toggle that hides tool activity behind an expandable per-turn summary with a live running-tool indicator. Toggle with
Ctrl+Alt+For the “Claude Code: Toggle Focus view” command. - Sandbox credential masking — New
maskmode for Linux and WSL: sandboxed commands read a sentinel copy of credential files (full file or regex-captured spans), while the sandbox proxy substitutes real values on egress. macOS falls back to deny. - Plugin validation warnings —
claude plugin validatenow warns when a marketplace or plugin name would be rejected by Claude Desktop’s managed marketplace sync. - Prompt audit tool — New
prompt-auditsubcommand on theclaude-apiskill, flagging prompts and tool descriptions written for older models. - PowerShell path fix — Permission checks no longer mishandle paths containing special characters.
The Focus view is the UX win. Anyone who’s watched Claude Code’s chat fill with tool-call noise will recognize the problem — Focus collapses that into a per-turn summary you can expand when you need the detail. The credential masking is more structural: it lets you run sandboxed commands against real config files without exposing secrets to the sandbox itself.
WARNING
If you’re on zsh and haven’t updated, commands embedded in [[ ]] regex conditionals could execute without a permission prompt. Update to v2.1.221 before running Claude Code against untrusted prompts or plugins.
Available now in v2.1.221. Run claude update or reinstall from the release page.