Claude Code 2.1.221 masks credentials from sandboxed commands
'mask' mode feeds sandboxed tools a decoy file and swaps the real key in on egress; the release also adds Focus view and patches two permission-bypass holes.
Copy markdown
'mask' mode: run agents without leaking your keys
Set a credential file to mode: "mask" and sandboxed commands read a sentinel copy — the sandbox proxy swaps the real secret back in only on egress, and an extract regex can scope it to specific spans. Linux and WSL today; on macOS it falls back to deny.
Focus view collapses the tool-call firehose
Ctrl+Alt+F (or 'Toggle Focus view') hides tool activity behind expandable per-turn summaries with a live running-tool indicator. On long agent runs you track the summary instead of scrolling past every Bash and Edit.
Two permission-bypass holes patched — update now
2.1.221 fixes a zsh bug that let hidden commands run inside [[ ]] regex conditionals, plus a Windows PowerShell case that mishandled quote-containing paths. Both could slip commands past permission checks, so anyone leaning on the sandbox should upgrade.
prompt-audit flags prompts written for old models
A new prompt-audit subcommand in the claude-api skill scans your prompts and tool descriptions for patterns tuned to older models — a quick cleanup pass after moving to Opus 5 or Sonnet 5.
WebSearch at max effort, plus a spend-limit fix
WebSearch no longer 400s at xhigh/max effort when thinking is off, and the spend-limit message stops blaming your org's monthly cap when it's really your individual limit — among roughly 15 reliability fixes.