If you dispatch parallel agents against a real repository, the release you want is Claude Code 2.1.222 — and the one you are probably running is not it. The 4 August 2026 release notes fix two agent-isolation failures by name (release v2.1.222). But npm's stable channel still resolves to 2.1.220, published eleven days earlier (npm dist-tags). Patched and installed are two different states here. Below: what shipped, how to tell which side of the split you are on, and what is still open.
What Claude Code 2.1.222 Actually Fixed
The first entry in the v2.1.222 release notes states that worktree-isolated sessions and the agents they spawn could run destructive git commands against the main checkout, and that isolation now applies to file edits and Bash in every session type. That is a containment bug, not a convenience bug: the whole point of isolation: "worktree" is that a run cannot touch the checkout you are working in.
The second entry is quieter and, for anyone running unattended work, worse. PreToolUse auto-allow hooks were bypassing tool restrictions inside background agent tasks — summaries, compaction, renames. A hook you wrote to approve a narrow set of calls was, in that path, approving more than it said. The hook contract is documented in the official hooks reference; the fix restores it where background work had been slipping past.
Both are the kind of defect you only see if you already run agents at volume. When we checked the Claude Code install on our own build workstation on 5 August 2026, it reported version 2.1.91 — published 2 April 2026, 109 releases before either isolation fix existed. We were not on stable or latest. We were on neither, which is its own answer to the question this post asks.
Why the stable Channel Does Not Have It
npm publishes three tags for this package. As of 5 August 2026 the registry returns {"stable":"2.1.220","latest":"2.1.222","next":"2.1.222"} (dist-tags endpoint). Version 2.1.220 went out on 24 July 2026; 2.1.221 and 2.1.222 both landed on 4 August. The stable channel is not one release behind the fix. It is two, across an eleven-day gap.
That gap is deliberate, and normally the right trade — stable exists so a team can take fewer, better-soaked updates. The problem is what it does to a security-shaped fix. A containment boundary that leaks is not something you defer on a soak schedule, because the exposure window is exactly the soak period. Pinning to stable is a decision; pinning without re-reading the release notes is an accident.
What the Install Numbers Show
npm's per-version API gives the real distribution (per-version download counts). In the seven days to 5 August 2026: 2,537,063 installs of 2.1.220, 1,152,760 of 2.1.221, and 360,695 of 2.1.222 — out of 13,756,818 across every published version. The patched build is roughly 2.6% of the week's installs.
Read that honestly: 2.1.222 was one day old at counting, so a low share is expected and will move. The durable finding is the long tail underneath it. Version 2.1.154 pulled 1,470,683 installs in the same window and 2.1.197 pulled 1,218,685 — releases from weeks earlier, still installed at scale. This is not an audience that upgrades on release day. It is an audience with pinned lockfiles, and every pin is a standing decision about which fixes you have — the same dependency drift we wrote up in our Codex security playbook.
The Isolation Boundary Still Has Open Reports
Two fixes are not a closed boundary. Filed on 4 August 2026 — the same day 2.1.222 published — is an open report of an orphaned process executing from a worktree path later reused by a different session. Also open: parallel worktree-isolated agents committing to each other's branches and mutating the main working tree (2 August), isolation locking Bash and Edit to the wrong repository when the task lives elsewhere (3 August), and the boundary being enforced inconsistently across Bash and PowerShell (31 July).
The permission side has its own open thread: bypassPermissions does not propagate to agents dispatched by the Agent tool (2 August). And the one that should worry anyone shipping from agent output — worktree-isolated agents returning confident results without disclosing that the worktree lacks your uncommitted work (31 July). That is a correctness failure wearing a green checkmark, the same failure mode we described when ARC-AGI-3 turned out to be measuring the harness.
None of this makes worktree isolation unusable. It makes it a control you verify rather than a control you assume — which is the position we have argued for the whole agent stack in why agents need a factory, not a better prompt.
Who Should Move Now, and Who Can Wait
Move now if either fix describes your setup: you dispatch parallel agents with isolation: "worktree" against a repository holding work you care about, or you rely on PreToolUse hooks to constrain unattended runs. Both paths were exposed before 2.1.222, and no configuration change substitutes for the patch. The Anthropic changelog carries the same two entries. Naming the controls you rely on and checking each one is the discipline we took from Tailscale's three controls.
Check where you actually are with npm view @anthropic-ai/claude-code dist-tags and claude --version, then compare the two. If your version predates 2.1.222, you do not have the fixes regardless of which channel you believe you are on.
You can wait if you run Claude Code as a single interactive session with human review on every write. The 2.1.222 fixes govern boundaries that only exist once agents run in parallel or unattended. Staying on stable one more cycle is defensible — as a decision, recorded, dated. The unrecorded version is how a team ends up on 2.1.91.
If you are standing up agent workflows and want the boundaries verified before they run against production repositories, that is the work we do — see our AI agent engineering practice.
Frequently Asked Questions
Does upgrading to Claude Code 2.1.222 require any configuration change?
No. Both fixes are behavioural: isolation now covers file edits and Bash in every session type, and PreToolUse auto-allow hooks stop bypassing restrictions in background tasks (release notes). Existing isolation: "worktree" settings and hook definitions keep working.
How do I tell which npm channel my install came from?
Run claude --version and compare it against npm view @anthropic-ai/claude-code dist-tags, which as of 5 August 2026 returns stable 2.1.220 and latest 2.1.222 (dist-tags endpoint). The version number is authoritative; the channel you think you installed from is not.
Is worktree isolation safe to rely on after 2.1.222? It is safer, not settled. Reports against the boundary remain open, including parallel agents mutating the main working tree and orphaned processes reusing a worktree path. Treat it as a control to verify, not a guarantee.
Why does the stable tag lag the latest tag at all?
The stable channel exists to give teams fewer, longer-soaked updates. As of 5 August 2026 that puts it at 2.1.220 from 24 July, two releases and eleven days behind 2.1.222 (npm dist-tags). The trade is deliberate; the exposure it creates for containment fixes is the part to price in.
Sources
- Claude Code v2.1.222 release notes — 4 August 2026
- Claude Code v2.1.221 release notes — 4 August 2026
- Claude Code v2.1.220 release notes — 24 July 2026
- npm dist-tags for @anthropic-ai/claude-code
- npm per-version download counts, trailing seven days
- Issue #83895 — orphaned process reusing a worktree path
- Issue #83311 — parallel worktree agents mutating the main tree
- Issue #83454 — isolation locks tools to the wrong repository
- Issue #83421 — bypassPermissions not propagating to dispatched agents
- Issue #82955 — isolated agents report confident false results
- Issue #83000 — boundary enforced inconsistently across tools
- Issue #83349 — worktree based on the default branch
- Claude Code hooks reference
- Claude Code changelog