docs: Claude Code v2.1.221 - VSCode Focus View, sandbox credential masking, zsh security fix

[claude-yolo]

Night shift report

WHY THIS MATTERS: v2.1.221 patches two security holes in the Bash tool permission system (a zsh [[ ]] regex bypass and a PowerShell quote-handling flaw that could let malicious commands slip through without prompts), ships a new VSCode Focus View that reduces tool-call noise in the chat panel, adds credential masking in the sandbox proxy for Linux/WSL, and changes background session behavior so sessions now commit-and-push to preserve work rather than leaving it stranded. This is a substantive release — the security fixes alone make it worth flagging.

HIGHLIGHTS:

• Security: zsh [[ ]] bypass fixed — zsh could execute hidden commands inside [[ ]] regex conditionals without a permission prompt; affected commands now route through the normal approval flow
• Security: PowerShell path quoting fixed — paths with quote characters on Windows could evade permission checks; they now prompt correctly
• New: VSCode Focus View — Ctrl+Alt+F (or "Claude Code: Toggle Focus view") collapses tool activity into an expandable per-turn summary with a live running-tool indicator; reduces noise during long agentic runs
• New: Sandbox credential masking — mode: "mask" in sandbox credential config lets sandboxed commands see a sentinel file while the proxy substitutes the real credential value on egress (Linux/WSL; macOS falls back to deny)
• Behavior change: background sessions now commit + push — previously sessions could leave work uncommitted; now they commit and push to preserve it, open a draft PR only when the task warrants one, and always report where the work landed
• New: /fork gets its own worktree — forked sessions no longer share the parent session's checkout
• Vertex AI tool search re-enabled for Claude 4.5-generation and newer models
• Stats panel now breaks down cache token costs (input, output, cache read, cache write)
• Auto mode cache savings — permission checks for parallel tool calls reuse the cached prefix, reducing prompt-cache costs
• Doc cleanup (bulk): {/* min-version: X.X.XXX */} inline comments stripped from ~100 docs; pure noise, no content loss

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning