Claude Code 2.1.221: Focus View, and the Fix Nobody Is Talking About

Claude Code 2.1.221 shipped on August 4, 2026 with 39 CLI changes. The feature everyone is quoting — Focus view — is a VS Code extension change, not a terminal one. And the entry that actually deserves your attention is a Bash tool permission-check bypass that got fixed quietly, three bullets down the list.

I've been reading these changelogs every week for months, and this one is a good example of how the highlight reel and the real content drift apart. So let's do both: what Focus view is, and what else is in there that the summaries skipped.

Is Focus view available in the terminal?

No. The official changelog entry is prefixed with [VSCode], which means it only affects the extension's chat panel. If you live in a plain terminal — iTerm, Ghostty, Windows Terminal, tmux, whatever — updating to 2.1.221 changes nothing about how your output looks.

I mention this because half the coverage I saw framed it as a terminal decluttering feature. It isn't. Your terminal is exactly as noisy today as it was yesterday.

What does Focus view actually do?

Focus view is a chat-menu toggle that collapses tool activity behind an expandable per-turn summary, with a live indicator showing which tool is currently running. You flip it on with Ctrl+Alt+F, or by running "Claude Code: Toggle Focus view" from the command palette.

The problem it solves is real if you work in the VS Code panel. Watching an agent grind through a twenty-minute refactor means watching every file read, every grep, every diff scroll past. You lose the thread of what it's actually doing. Focus view gives you the summary and keeps the details one click away.

Is it worth updating for on its own? If you use the extension, yes — it takes thirty seconds and you'll notice it immediately. If you don't, skip to the next section, because that's where the release gets interesting.

What is the most important fix in 2.1.221?

This one:

Fixed a Bash tool permission-check bypass where zsh could execute hidden commands in [[ ]] regex conditionals; affected commands now prompt for permission.

Read that again. The permission system is the thing standing between an agent and your filesystem. A command that slipped past the check ran without you approving it. Under zsh, double-bracket regex conditionals were a hole in that check, and 2.1.221 closes it.

There's a companion fix on the Windows side: PowerShell permission checks were mishandling paths that contain quote characters, and those now prompt for approval too.

Neither of these made the highlight bullets anywhere I looked. Both matter more than a chat panel toggle. If you run Claude Code with anything other than the strictest permission mode — and most people do, because strict mode is exhausting — this is the entry that should push you to update today rather than next week.

The full picture: what's in the 39 changes

Here's how the release actually breaks down, with the entries I'd flag:

The -p print mode fix is the sleeper hit for anyone running Claude Code in CI. If your MCP servers weren't connected before the first turn, the model would print tool calls as plain text instead of executing them — which looks like the model being dumb, when it was really a startup race. I've seen people file bug reports about "hallucinated tool calls" that were almost certainly this.

Why does Claude Code keep telling itself to use ripgrep?

This is where I want to push back on the popular summary of this release.

The changelog tracker's highlights included "Grep note recommends ripgrep-backed tool, documents output modes and line/offset limits for stable searches." Sounds new. It isn't. The same nudge shipped in 2.1.150 ("tool descriptions now use ripgrep-based grep"), again in 2.1.215 ("documentation designates ripgrep as the primary search tool"), again in 2.1.217 ("prompts instruct use of the ripgrep-backed Grep tool"), and now again here.

Grep has been ripgrep-backed under the hood for a while — it uses the bundled @vscode/ripgrep package, not GNU grep. What keeps getting revised is the description text the model reads, nudging it to reach for the Grep tool instead of shelling out to grep via Bash. Four passes at the same paragraph across roughly seventy releases tells you something: getting a model to consistently pick the right tool is prompt engineering, and prompt engineering is iterative and annoying.

Same story with the Write tool bullet. "Write tool documented to create or modify local files, clarifying outputs will alter disk state" is a tool-description tweak, not a product change.

Here's the part worth knowing: neither the Write nor the Grep item appears in Anthropic's official GitHub changelog for v2.1.221. They come from the @ClaudeCodeLog account, which diffs the shipped bundle's prompt files between releases and reports what changed. That's genuinely useful reporting — it surfaces things Anthropic doesn't write release notes for — but it means the "three highlights" everyone is quoting are two prompt-file diffs and one VS Code toggle, while an actual permission bypass fix sits unmentioned.

There is one official entry pointing the same direction: 2.1.221 adds a prompt-audit subcommand to the claude-api skill for auditing prompts and tool descriptions written for older models. Anthropic is clearly doing a sweep of its own tool text, and shipping the tooling to let you do it to yours.

Sandbox credential masking is the underrated addition

The genuinely new capability in this release is mode: "mask" for sandbox credential files on Linux and WSL.

How it works: a sandboxed command reads a sentinel copy of the credential file — either the whole file, or just the spans captured by an extract regex — while the sandbox proxy substitutes the real value on egress. So your agent can read a config that references an API key, run a command that uses it, and never actually have the secret in its context. On macOS this falls back to deny.

That's a meaningful step for anyone letting agents touch a .env. Most current setups are all-or-nothing: either the agent sees the key or the command fails. Masking splits the difference. I haven't stress-tested this on a real project yet — it landed today — so treat my enthusiasm as provisional.

Background sessions grew up

One more behaviour change worth calling out: background sessions now commit and push to preserve work, open a draft PR only when the task calls for one, follow your CLAUDE.md git instructions, and always end by reporting where the work lives.

The old failure mode was a background job finishing and you having no idea which worktree it left the changes in. Combine that with /fork now creating its own worktree instead of sharing the original session's checkout, and /status reporting whether a session is interactive, attached or unattached, and you get a coherent story: Anthropic is fixing the "where did my agent put my code" problem.

This matters more as people run more parallel agents. It's the same direction of travel we saw when Opus 5 landed with its pricing shakeup — the models got cheap enough that running several at once became normal, and the tooling is catching up to that.

Should you update?

Yes, and specifically because of the permission fixes rather than the feature.

claude update

Or reinstall globally:

npm install -g @anthropic-ai/claude-code

The VS Code extension updates on its own track through the marketplace — you need that one for Focus view.

A fair warning on expectations: 2.1.221 is a maintenance release wearing a feature release's press coverage. Twelve of the 39 entries are bug fixes. Seventeen are behaviour tweaks. Four are additions. One is a removal. Nothing here changes what Claude Code can do; it changes how often it does the wrong thing.

That's fine. That's what a good week of shipping looks like when a tool is already working. I'd rather have the zsh bypass closed than another panel.

Official announcements

Watch

If you're weighing Claude Code against the alternatives, we've covered Cursor's push into Google Workspace and keep a running list of the top AI tools of 2026.

The pattern I'd watch over the next few releases is the tool-description churn. Four attempts to get the model to reliably prefer one search tool, in a codebase where that tool has been the default for months, is a quiet admission that steering model behaviour through prompt text is still guesswork. Whoever solves that properly — reliable tool selection without a paragraph of pleading in the description — wins more than any panel toggle ever will.