Claude Code 2.1.221 now lets Linux and WSL2 users mask credential files before a sandboxed command can read them. The feature feeds the command a harmless sentinel copy and swaps in the real secret only when an allowed request passes through a proxy.

What the masking flow looks like

  1. Sentinel copy – When a file is marked for masking, Claude Code creates a duplicate that contains a placeholder string instead of the actual secret.
  2. Proxy swap – The sandbox runs behind a TLS-terminating proxy. If the sandbox issues a request that matches an entry in the injectHosts list, the proxy replaces the placeholder with the real token before the request leaves the machine.
  3. Error handling – If the extraction regex fails to find a secret, the sandbox can abort instead of proceeding with the original file exposed.

The approach works only on Linux and WSL2; macOS currently defaults to a hard deny, meaning the sandbox cannot read the file at all.

Checklist for a safe rollout

Verify the version

  • Confirm you are running Claude Code 2.1.221 or newer. The version string in a terminal is the only reliable method; package lock files can mislead.

Use disposable tokens

  • Never experiment with your primary GitHub or cloud credentials. Create a short-lived token that points at a harmless “canary” endpoint and revoke it instantly if something goes wrong.

Choose the right masking mode

Mode When to use
File Deny Hard block; any read attempt fails.
Whole-File Mask File contains a single secret (e.g., a plain-text API key).
Structured Mask File mixes secrets with other data (JSON, YAML, .netrc). Use extract mode and a regex that captures the secret in group 1. This keeps surrounding syntax valid for the client program.

Set strict error rules

  • Set onExtractNoMatch to error. If the regex does not match, the sandbox stops. Leaving it at the default warn could let the original file slip through unnoticed.

Enable TLS termination

  • The proxy must terminate TLS to perform the swap. Without TLS termination, the proxy cannot see the request payload and the substitution never happens.

Tighten host scope

  • Populate injectHosts with explicit hostnames from your allowedDomains. Avoid wildcards like *.example.com; broad patterns widen the attack surface and defeat the purpose of masking.

Verify the outcome

  • Scan logs, process arguments, and error messages for any appearance of the real token. The sentinel should be the only value that ever surfaces in those artefacts.

The limits you need to keep in mind

Masking secures the token only from the sandboxed command’s file-system view. It does not stop the command from making arbitrary network calls, nor does it protect against Claude’s built-in tools that may have privileged access.

Bottom line

Claude Code 2.1.221’s credential-masking feature gives Linux and WSL2 developers a practical way to keep secrets out of sandboxed processes.