Claude Code 2.1.224 adds cross-session messaging, drops subagent cap
Sessions across your machines can now coordinate; the update also ships signed-zip plugins, self-hosted runners, sandbox secret-masking, and two bypass fixes.
Copy markdown
Your sessions can now talk to each other
SendMessage and ListAgents let one Claude Code session hand work to another across any of your machines and read the reply — a coordinating fleet with no custom message bus. Inbound delivery is gated by new crossSessionInbound and dialogExpiry approval settings (macOS and Linux).
The 200-subagent cap is gone
The per-session limit of 200 spawned subagents was removed, so long-running sessions no longer refuse new agents mid-run. Big fan-outs and orchestration loops don't have to batch under 200 anymore; depth and concurrency limits still apply.
Install plugins from a signed zip
A new 'archive' plugin source installs a plugin from a zip over HTTPS — no git, no npm — with optional SHA-256 pinning. Pin the hash and you get exactly those bytes, which makes locking a plugin build or shipping an internal one trivial.
Run cloud sessions on your own machines
claude self-hosted-runner turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions can run (Team and Enterprise). Keep the agent's compute and your code on infra you control.
Mask secrets before they reach the model
Sandbox credential masking gained JWT-aware handling (decode: "jwt" with maskClaims) and AWS SigV4 re-signing, so tokens and signed requests can flow through tools without exposing the raw secret to Claude.
Two sandbox bypasses patched — update tonight
Long (>200-char) project paths could resolve into another project's session directory under a shared prefix, and sandbox deny entries written with a trailing slash (e.g. denyRead: "~/.aws/") were silently bypassable on Linux and macOS. Both are fixed in 2.1.224.