The v2.1.225 release of Claude Code, shipped August 8th, adds two operational controls: the gateway spend-limit that specifies the spending cap, reset time, and operator message when the limit triggers, and the workspace trust prompt for claude agents on untrusted directories, which aligns subagent behavior with the main command. The v2.1.226 release, published hours later, brings only bug fixes and reliability improvements.

If you run Claude Code with agents in parallel or on external repositories, these two controls address two concrete problems. The spend-limit tells you when you’re burning budget and when it resets, without manual checking. The workspace trust prompt stops an agent before it enters a directory you haven’t approved, reducing the risk it executes code or reads files from an unverified source.

As we covered on August 5th, Claude Code is in a phase of weekly releases shifting focus from new features to governance: session isolation, granular permissions, credential masking. The spend-limit and workspace trust bring the tool closer to production use where cost and security aren’t managed by memory.

In detail

The gateway spend-limit isn’t a feature that activates on its own in the terminal. It lives in the AI Gateway, the component that acts as intermediary between Claude Code and Anthropic’s API. When you set a spending cap on the gateway, before this release the message you received was generic: the agent would stop and tell you it hit a limit. From v2.1.225, the message includes three precise details: the numeric cap, the reset time, and the operator’s custom message (whoever administers the gateway can write, for example, “Project budget exhausted, retry tomorrow at 9am”). The requirement is that the gateway itself is also updated to 2.1.225: if you’re on an earlier version, the old generic message keeps showing.

The workspace trust prompt closes a coherence gap. The claude command (the main session) already asked for confirmation before working in an untrusted directory. But claude agents, the subcommand that launches subagents, didn’t: a delegated agent could enter an external directory and start reading or modifying files without your explicit approval of that path. Now behavior is aligned: if the directory isn’t in the trusted workspace list, the agent stops you and asks for confirmation.

The rest of the release is packed with fixes that show the tool’s maturity. The transient 401 token bug appeared when a long-lived OAuth token was replaced by a short-lived one stored at login: headless sessions (those running without interface, in CI or scripts) broke until restart. The fix for MCP OAuth servers on macOS resolves a similar issue tied to the keychain: when keychain reads timed out, MCP servers received a flood of 401s as if never authenticated.

There’s also a logic fix: in auto mode, a safety filter rejection on the agent’s own permission check was counted toward the limit of consecutive blocks. The action stayed denied, but the model received an ambiguous signal and tended to retry the same action. Now the system tells the model to proceed, not to insist.

Remote Control sessions (controlling Claude Code from another machine, say from your phone) receive several improvements: photos attached from the Claude app are shown directly to the model instead of read from disk with a separate tool call, and SendMessage can start a conversation with a remote session by name instead of just replying.

The v2.1.226 release, out hours after 225, is a bug fix and reliability release only. No new features.

What stays open. The spend-limit requires the updated gateway: if your infrastructure doesn’t use it, the feature is invisible. The workspace trust prompt protects from entry into unapproved directories, but doesn’t replace verification of what’s inside: a workspace you approved once stays trusted even if contents change. For those running agents in production, the course on costs, latency and security remains the reference for understanding where these controls fit in the bigger picture.