Claude Code closes a worktree isolation gap

Version 2.1.222 fixed two containment gaps in the same release. Worktree-isolated sessions and their subagents could run destructive git commands against the main checkout; isolation now applies to file edits and Bash in every session type. Separately, PreToolUse auto-allow hooks were bypassing tool restrictions inside background agent tasks such as summaries, compaction and renames. The same release removed the "ultraplan" feature and changed Remote Control so a repository's own settings file can no longer silently turn it on, only off.

Why it matters: If your operating assumption is that a git worktree keeps a background agent's mistakes off your main checkout, that assumption did not hold for subagents until yesterday. Anyone running parallel or unattended Claude Code sessions on the strength of worktree isolation should treat this as the point their containment story actually became true, not before.