Claude Code 2.1.222 Fixes Silent Gateway Stream Drops and a Background-Task Hook Bypass

The headline change in Claude Code 2.1.222 is not a feature — it is a silent failure mode that nobody logged. If your team routes Claude Code through a custom ANTHROPIC_BASE_URL gateway — an AI routing proxy, an AWS Bedrock endpoint, a local proxy for compliance — a bug in the stream idle timer has been silently killing connections that the gateway's server side considered healthy.

Here is what operators should know before this release reaches your fleet.

The stream timeout bug: what actually broke on custom gateways

Claude Code's stream idle timer fired when no bytes arrived on the wire within its timeout window. The intent was to detect stalled responses. The bug: the timer did not recognize keepalive frames sent by the gateway server. So when your gateway correctly maintained the TCP connection with periodic keepalive pings, Claude Code's client saw a quiet wire and declared the stream dead — even while a slow-responding model was still computing.

The failure mode looked different depending on your retry logic:

• Without retries: the CLI reported "Connection closed mid-response" on a response that had actually completed on the model side but whose last bytes were buffered in the gateway's write path.
• With retries: the same request was replayed against the upstream provider, doubling cost and latency for any slow generation.
• In background agent tasks: silent failures accumulated across subagent turns, making long-horizon agentic sessions appear unreliable on non-Anthropic endpoints.

The fix in 2.1.222 makes the idle timer proxy-aware: it resets on any incoming data, including keepalive frames, regardless of whether the bytes constitute a model response chunk. Teams running ANTHROPIC_BASE_URL set to a routing proxy, an Azure AI Foundry endpoint, an AWS Bedrock-compatible URL, or a local proxy for enterprise traffic inspection should see the disconnection pattern disappear after updating.

Cross-provider keepalive behavior: why this is a routing-layer problem

Keepalive behavior varies meaningfully across AI gateway implementations:

• Direct api.anthropic.com: sends response chunks at predictable intervals; idle gaps are short. The old timer threshold was calibrated for this traffic pattern.
• Bedrock / Vertex AI: proxy layers add latency; model-side compute takes longer before bytes start flowing. Silent intervals between the first request and first token are longer by design.
• Custom AI routing proxies (aggregators, local MITM proxies for audit): may buffer output before forwarding, introducing silent windows of 10–30 seconds that exceed Claude Code's old timer threshold.

None of these gateways were doing anything wrong — they send keepalives precisely to prevent the client from declaring the connection dead. The Claude Code timer was simply ignoring those keepalives. The fix brings it in line with how any well-behaved HTTP/2 or SSE client handles idle detection.

Operators who rolled their own retry wrapper around ANTHROPIC_BASE_URL to compensate for the disconnects can now remove that layer. For teams routing Claude Code through TheRouter, this also means the gateway keepalive behavior is now correctly respected — see the TheRouter docs for the current base URL configuration.

Background-task hook bypass: PreToolUse in summaries, compaction, and renames

The second fix closes a governance gap in background agent task execution. Claude Code has a PreToolUse hook that operators configure to control which tools may run automatically (without asking the user). In 2.1.222, that hook was not being evaluated in background tasks — specifically in session summarization, context compaction, and file rename operations that Claude Code runs autonomously between turns.

The practical consequence: a PreToolUse rule blocking, for example, Bash tool execution in your policy, would not apply when compaction triggered a shell command internally. A tool restriction intended to gate production-affecting commands could be bypassed by triggering it through a background compaction path.

The fix enforces the PreToolUse evaluation in every task type, background or foreground. Operators who rely on hook-based access control should treat 2.1.222 as a required security update if their deployment uses background agent sessions.

Worktree git-command scope: what changed vs. 2.1.216

Claude Code 2.1.216 fixed a worktree isolation escape where subagents could redirect git operations back into the shared parent checkout via flags (--git-dir, -C <shared-path>) or environment variables (GIT_DIR, GIT_WORK_TREE). That patch fixed file-edit isolation.

2.1.222 extends the fix to destructive git commands via Bash inside worktree-isolated sessions. A subagent running in a worktree could execute git reset --hard, git push --force, or git branch -D targeting the main checkout by constructing the command with an explicit path. This was allowed by the Bash tool even when file-edit isolation was in place because the Bash tool did not inherit the worktree path restriction.

As of 2.1.222, isolation applies to file edits and Bash in every session type, including subagents spawned inside a worktree-isolated parent. The commit message for the fix is explicit: "isolation now applies to file edits and Bash in every session type."

For operators running parallel subagent pipelines on separate branches — feature development, code review automation, dependency upgrade bots — audit any agentic Bash commands that executed before 2.1.222 if those agents were git-aware and had write access to repository paths.

MCP usage attribution and org model alias fixes

Two additional fixes have billing and governance implications:

MCP server usage attribution was overattributing: /usage counted every turn after an MCP tool call as being attributed to that server, even if subsequent turns never touched the MCP tool's results. 2.1.222 fixes this so a server's usage share reflects only requests that actually consumed its output. If you run per-team chargeback by MCP server, your numbers will drop after the update — correctly.

Org-restricted model aliases (model: opus, model: sonnet) were falling back to the parent model when the literal alias resolved to a model outside the org's allowed set. They now step down to the newest org-allowed model in the requested family. For operators who set model family aliases in managed settings, this changes fallback behavior: the agent now picks the most current allowed model in the family instead of silently using the initiating model.

What to change after updating

Remove ANTHROPIC_BASE_URL retry wrappers you added to compensate for stream disconnects. The underlying bug is fixed; a retry layer on top may now produce duplicate requests for responses that succeed on first attempt. Verify the correct ANTHROPIC_BASE_URL value in your Claude Code configuration against the TheRouter models page for available model IDs.

Audit PreToolUse hook coverage in your managed settings. The hook is now enforced in background tasks — but if your previous deployment assumed it was not, verify your hook logic handles the background task surface area correctly. A hook that expected to only gate interactive turns may now trigger during compaction runs.

Audit recent parallel subagent git activity on worktree-isolated branches. In 2.1.216–2.1.221, a subagent inside a worktree could still issue destructive git commands via Bash. If any of your agentic CI pipelines ran during that window, compare expected branch states to actual git history in the shared checkout.

Check org model alias resolution if you pin family aliases in managed settings and noticed fallback models appearing in your request logs. The new step-down behavior may route to a different model than the previous fallback.