Claude Code 2.1.224 puts sessions on your own hardware and lifts the subagent cap

Three changes matter for anyone running a fleet. claude self-hosted-runner "turns your own machines or containers into a place Claude Code web, mobile, and desktop sessions can run," on Team and Enterprise plans. Cross-session SendMessage arrives with ListAgents, so sessions can message each other across your machines on macOS and Linux. And the 200-subagent-per-session spawn cap is gone, with concurrency and depth limits still applying.

The release also fixes sandbox filesystem deny entries written with a trailing slash, the example given is denyRead: "~/.aws/", were "silently bypassable on Linux and macOS." A separate fix makes sandbox violation details appear in Bash tool results, so Claude now sees which file or network access was denied and why.

Why it matters: If your containment story rests on sandbox deny rules, go look at how yours are written before you assume they held. A trailing slash is the kind of thing nobody audits. The self-hosted runner and cross-session messaging matter more long term: the unit of work is drifting from one session on one laptop toward a set of addressable sessions on infrastructure you control.