claude code 2.1.221: focus view, zsh security fix, and 39 cli changes

Claude Code v2.1.221, released August 3, 2026, is a dense release: 4 new features, 2 security fixes, 16 other bug fixes, 15 improvements, and 3 behavior changes — 39 CLI changes total. The headlining addition is Focus view, a UI mode that collapses the wall of tool call output that makes long agent sessions hard to follow. The headlining fix patches a Zsh shell behavior that could allow a hidden command to bypass the Bash tool's permission check.

focus view: less noise, same transparency

Focus view hides tool activity behind a compact per-turn summary instead of streaming every file read, grep output, and bash command inline. A live running-tool indicator shows something is happening; you expand the summary to see what. The toggle is Ctrl+Alt+For the "Claude Code: Toggle Focus view" command in the command palette.

The problem it solves is real. A complex agent session — one involving parallel subagents, multi-file edits, and external API calls — produces thousands of lines of tool output before it surfaces a result. Following what the agent is actually doing becomes harder, not easier, as the tool gets more capable. Focus view trades completeness for legibility by default, while keeping the full detail one expand away.

This is the same tension that Cursor addressed with its Side Chat feature in v3.11 and that every terminal-first tool eventually has to answer: agents are productive precisely because they do a lot of work autonomously, and that work produces output that is noisy to read. The approaches differ — Cursor separates parallel threads spatially, Anthropic collapses sequential detail — but the diagnosis is shared.

zsh permission bypass fix

The higher-stakes fix in v2.1.221 closes a Bash tool permission-check bypass. When Claude Code runs a shell command, it checks it against an allowed-commands list before executing. The bypass was specific to Zsh: under certain conditions involving regex conditionals, Zsh could execute a hidden command without triggering the permission check. The release notes describe this as a "zsh could execute hidden commands in regex conditionals" failure mode.

If you are running Claude Code on macOS (where Zsh is the default shell since Catalina) or on a Linux environment configured with Zsh, updating to v2.1.221 closes this. The fix is a behavior change to how the Bash tool validates commands in Zsh before execution. The release also adds a second security fix for a sandbox credential file on Linux and WSL: credential files can now be opened with mode: "mask", which prevents the content from being readable by the agent even in sandboxed environments where the file is present.

stats panel and cache token accounting

The Stats panel now counts cache tokens — cache reads and cache writes — in its token total display, with a breakdown by input, output, cache read, and cache write. Previously, cache activity did not show up in the stats, which made the token count misleading for sessions that were actually doing heavy cache reuse.

For Claude Code users on Claude Sonnet 5 (now the default model, at a promotional $2/$10 per million tokens through August 31, 2026), cache reads are priced significantly lower than uncached input tokens. Being able to see the breakdown directly in the Stats panel makes it possible to understand how much your session is actually costing and whether long-context reuse is working as expected.

the pace of releases

v2.1.221 is the third major release since the subagent guardrails incident in late July, when v2.1.217 emergency-disabled nested agent spawning and v2.1.219 reinstated it with a depth-3 cap. The pace since then — v2.1.220 and v2.1.221 both released in early August — suggests Anthropic is in an active hardening phase: each release closes a permission or isolation gap that the rapid subagent capability expansion opened. Focus view is a UX improvement on top of that; the Zsh bypass fix and credential masking are the ones to take seriously.