Claude Code 2.1.222–2.1.226 — self-hosted runners, tighter isolation, and archive plugins

Claude Code 2.1.222 through 2.1.226 ship in a tight cluster: two security-hardening releases, a self-hosted-runners feature, and general reliability fixes. The headline capability is self-hosted execution; the security changes are worth acting on regardless.

What changed

• Self-hosted runners (2.1.224): the new claude self-hosted-runner command turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions can execute, on Team and Enterprise plans.
• Archive plugin source (2.1.224): install plugins from a zip over HTTPS without git or npm, with optional SHA-256 pinning.
• Worktree isolation hardened (2.1.222): worktree-isolated sessions and their subagents can no longer run destructive git commands against the main checkout. The same release fixed PreToolUse auto-allow hooks bypassing tool restrictions in background agent tasks.
• Marketplace org wildcards (2.1.223): strictKnownMarketplaces and blockedMarketplaces now accept "owner/*" entries to allow or block every repo under a GitHub org.
• Gateway spend limits + workspace trust (2.1.225): the usage warning now names the gateway spend cap and reset time, and claude agents prompts for workspace trust in untrusted directories.
• Version 2.1.226 (Aug 8) is bug-fix-only.

Why it matters

Self-hosted runners address a clear pain point: if you want Claude Code sessions to run on your own infrastructure — for compliance, privacy, or to reuse a beefy build box — there is now a first-class command for it.

For every user, the 2.1.222 fixes matter more. Two earlier hardening releases (2.1.219) made sandboxing and subagent limits stricter; these releases close real gaps where an isolated worktree or a background agent task could still act outside its intended boundary.

What to do

claude update

If you run agent teams or rely on worktree isolation, upgrade and re-test your destructive-git and tool-restriction hooks. If you use gateways with spend caps, upgrade so the limit-reached message surfaces the cap and reset time. On Team or Enterprise, evaluate self-hosted runners if you need sessions to execute on your own infrastructure.

Claude Code v2.1.222 release notes · v2.1.223 · v2.1.224 · v2.1.225 · v2.1.226