Claude Code v2.1.222: worktree isolation patched after subagents could hit main checkout

Claude Code v2.1.222 patches a worktree isolation gap that let subagents run destructive git commands against the main checkout.

The fixes shipped in v2.1.222:

• Worktree isolation — subagents in isolated sessions could run destructive git commands against the main checkout; isolation now covers file edits and Bash in every session type
• PreToolUse hook bypass — auto-allow hooks were skipping tool restrictions in background agent tasks (summaries, compaction, renames)
• MCP usage attribution — /usage was charging every turn after an MCP call to that server; now only counts turns that actually consumed its tool results
• Proxy connectivity — startup check hung behind HTTPS proxies; now uses proxy-aware transport with clear timeout messages
• Spurious errors — “Connection closed mid-response” reported on completed responses; /usage-credits blocked Team and Enterprise members from resubmitting after a dismissed request

The worktree fix is the one that matters. If you’ve been running background agents or subagents in worktree-isolated sessions, those agents had a path to destructive git operations on your main checkout — force pushes, resets, branch deletes. The isolation was supposed to prevent exactly that. It didn’t, and now it does.

The MCP attribution fix matters for anyone tracking per-server costs. A single MCP call inflated that server’s usage share for every subsequent turn in the session, making it look like an MCP server was burning far more tokens than it actually was.

Update to v2.1.222 if you use worktree-isolated sessions, background agents, or MCP servers with usage tracking. The isolation fix alone is the reason to upgrade this week.