Claude Code 2.1.228 patches a conversation-history leak in Remote Control

Claude Code 2.1.228 landed as a maintenance release with 18 changelog entries, among them a Remote Control bug that leaked a resumed conversation's title or history into the session already connected. The notes, published on Github, list fixes, hardening work and one behavior change in the Write tool.

At a glance

• Skills synced from claude.ai no longer shadow local commands or MCP prompts, their descriptions are sanitized and labeled, and on the local machine their bodies neither run ! commands nor expand @ files.
• The Write tool now lets newer models overwrite a file they have not read in the current session, matching Edit's rules, while older models still have to read the file first.
• Expired or missing Google Cloud credentials now fail within seconds on Vertex AI instead of retrying for minutes, cutting the wait before a misconfigured deployment surfaces an error.

Why it matters Three of the fixes touch state that persists beyond a single run: the Remote Control leak, session cleanup reaching inside a project's memory folder, and plugin-cache cleanup removing a symlinked development checkout. That combination reads as a release aimed at the parts of the tool that quietly destroy or expose data rather than fail loudly. The skills hardening points the same way, restricting what content synced from claude.ai is allowed to do on a local machine.

Remote Control /resume leaked the resumed conversation into the connected session

When /resume ran inside an active Remote Control connection, the resumed conversation's title or history could surface in the session already connected. The release closes that path. Cross-session messaging had a related gap: the first session after an install or an upgrade sometimes started without an inbox at all.

Two cleanup routines were removing files they should have left alone. Session cleanup deleted contents inside a project's memory folder, and the background plugin-cache sweep deleted a plugin's cache when its only version was a symlinked development checkout.

Self-hosted runner sessions failed on every fresh runner when a checkout hook broke

The claude self-hosted-runner command failed on every fresh runner when the checkout hook failed for a repository the session does not push to. Such a repository is now skipped with a warning instead of ending the run. Separately, self-hosted runners ended sessions in the gap between a background task finishing and the follow-up turn starting.

Two more fixes affect configuration and prompting. A marketplace entry redefined in a higher-precedence settings tier could inherit custom headers from another tier, so marketplace entries now merge as whole entries, and the deferred-tools reminder occasionally reached the model twice after a skill invocation.

Interactive sessions could stop redrawing while the process kept running

A rare internal layout error could leave an interactive session frozen on screen while the underlying process continued to work. On Windows, git and Git Bash were not found when Claude Code was launched from a parent folder of the git installation. The /tui command reverted a session to an earlier model when /model had been changed since the last response.

Cross-session messages now show the sender and body inline rather than as a collapsed line, and messages sent to Remote Control sessions on other machines carry the Remote Control session name as the sender. The terminal title busy-spinner glyphs were changed to reduce tab-bar jitter on some terminals.

Compaction now shows the retry countdown and the stall hint while it runs, where earlier builds displayed only a progress bar. The release also drops the outdated note about auto mode sessions costing slightly more from the first-use notice on Pro, Max and Team plans.

What's next The release notes do not say which models count as newer for the Write tool rule, so the read-before-overwrite requirement remains version-dependent in practice. Nothing in the entry list points to a scheduled feature drop, and no date is given for the next build. The skills hardening also leaves open how synced descriptions will be labeled in the interface, since the notes state only that they are sanitized and labeled.