claudekit / updates / claude-code-2-1-214
[ PATCH · ]

Claude Code 2.1.214

A release centered on permission-check hardening. Single-segment rules like `Edit(src/**)` that auto-approved writes to nested `dir/` directories anywhere in the tree, a permission-check bypass in Windows PowerShell 5.1 sessions, and Bash permission checks misjudging file-descriptor redirects and very long commands (over 10,000 characters) all now fail closed. A new EndConversation tool lets Claude end sessions with highly abusive users or jailbreak attempts, and long-running tool calls get a periodic progress heartbeat. Background daemon and session lifecycle, Windows PowerShell tool reliability, and streaming/proxy fixes round out the release.

Claude Code
Official announcement →

This article is a summary based on official documentation.

What changed

Claude Code 2.1.214 shipped on July 18, 2026. Permission-check hardening is the center of this release: over-eager auto-approval from single-segment rules like Edit(src/**), a permission-check bypass in Windows PowerShell 5.1, and Bash permission checks misjudging file-descriptor redirects and commands over 10,000 characters all now fail closed. A new EndConversation tool and a progress heartbeat for long-running tool calls land alongside a large batch of fixes to background daemon and session lifecycle, Windows PowerShell tool reliability, and streaming behind corporate proxies.

New features

  • EndConversation tool

    Claude had no way to end a conversation, so sessions with highly abusive users or jailbreak attempts kept going. Claude can now end those sessions with the new EndConversation tool — a safeguard that has been on claude.ai since 2025.

  • Progress heartbeat for long-running tool calls

    Long-running tool calls produced no output until they finished, so they looked stalled. A periodic progress heartbeat now shows that work is still in flight.

  • Reasoning effort in the subagentStatusLine payload

    Custom agent rows could render the model but not the reasoning effort. Reasoning effort is now added to the subagentStatusLine payload, so custom agent rows can render both model and effort.

  • ISO modified timestamp in memory file frontmatter

    Memory files didn’t record when they were last changed. An ISO modified timestamp is now added to memory file frontmatter.

  • OpenTelemetry correlation and provenance attributes

    There was no way to correlate log events at the message level or trace tool provenance. message.uuid, client_request_id, and tool_source attributes are now added to OpenTelemetry log events, and CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH configures the 60 KB truncation limit on OpenTelemetry content attributes.

Key improvements

  • dir/** hook if: conditions now match only <cwd>/dir

    Single-segment dir/** hook if: conditions matched a dir/ anywhere in the tree. They now match only <cwd>/dir; write **/dir/** for any-depth matching. deny/ask permission rules keep their any-depth match.

  • file commands with -m/--magic-file or -f/--files-from require permission

    These options were auto-allowed as read-only. They now require permission instead.

  • Keep-alive connection pooling disables after a stale-connection error

    The connection pool was reused even after a stale-connection error, so retries hit the same dead socket. Keep-alive pooling now disables after such an error, so retries open a fresh socket.

  • SessionStart hooks report "fork" source

    A session that began as a fork was reported as "resume". SessionStart hooks now report source "fork" when a session begins as a fork.

  • Clearer claude rc workspace-trust error in the home directory

    The workspace-trust error in the home directory was unclear. It now says trust there is never saved and suggests running from a project directory.

Bug fixes

Permission checks

  • Single-segment dir/** allow rules like Edit(src/**) auto-approving writes to nested dir/ directories anywhere in the tree — they now apply only to <cwd>/dir.
  • A permission-check bypass affecting commands run in Windows PowerShell 5.1 sessions — fixed.
  • Bash permission checks not failing closed on file-descriptor redirect forms that bash parses differently than the permission analyzer — fixed.
  • Bash permission checks misjudging very long commands — commands over 10,000 characters now always prompt instead of running automatically.
  • Bash permission checks treating zsh variable subscripts and modifiers in [[ ]] comparisons as inert text — these commands now prompt for approval.
  • Certain help and man commands that could run unsafe options, command substitutions, or backslash paths being auto-approved — fixed.
  • Permission prompts on remote sessions that could proceed before the local confirmation dialog — fixed.
  • docker commands (including the Podman docker shim) carrying daemon-redirect flags (--url, --connection, --identity, and Podman’s remote mode) running without a permission prompt — they now prompt.

Background sessions & daemon

  • A displaced background daemon deleting its successor’s control socket on shutdown, which made the next client kill the healthy replacement daemon — fixed.
  • Background sessions parked with ← or /background and left idle keeping the background daemon and a worker process alive indefinitely — fixed.
  • Completed background sessions being impossible to remove via claude rm or the agent view once the background service had gone idle — fixed.
  • Background sessions dispatched from a non-git folder being impossible to delete from the agents view — fixed.
  • Reopening a stopped background session failing to restore its saved conversation when an unreadable folder exists in the session store — fixed.
  • The Remote Control “session ready” push notification firing for sessions where Remote Control was not explicitly enabled — fixed.
  • /install-github-app and the /mcp settings menu being blocked in agent-view sessions — they’re now refused only in background sessions with no terminal attached.

Windows & PowerShell tool

  • Streaming turns failing with “Socket is closed” behind corporate proxies on Windows — fixed.
  • PowerShell tool commands hanging until timeout when a child process waited on standard input (Windows) — fixed.
  • Python scripts under the PowerShell tool crashing with UnicodeDecodeError when reading non-UTF-8 data from standard input (Windows) — fixed.
  • Python scripts run via the PowerShell tool crashing with UnicodeEncodeError on non-ASCII output, and PowerShell 7 error messages containing raw ANSI escape sequences (Windows) — fixed.
  • The PowerShell tool reporting where.exe, fc.exe, and diff.exe as errors when they return a valid negative answer (Windows) — fixed.
  • > and >> under the PowerShell tool on Windows PowerShell 5.1 writing UTF-16LE files that other tools couldn’t read as UTF-8 — fixed.

Streaming & telemetry

  • stream-json output truncation at exit for slow-reading SDK/pipeline consumers — the exit drain now scales with queued bytes instead of a flat 2s cap.
  • Session cost and token telemetry double-counting on streams that emit multiple cumulative message_delta frames — fixed.
  • OTel log events emitted outside the turn’s async context missing the interaction span’s trace context — fixed.
  • Feature flags going stale in long-running sessions after the OAuth token rotates — fixed.
  • A crash when a GrowthBook feature evaluates to null, and a bug where a malformed flag payload could wipe the cached feature flags — fixed.

Other

  • The Bash tool killing the Claude session when a pkill -f pattern accidentally matched the CLI’s own process (Linux) — fixed.
  • Unbounded memory growth when --settings points at a device file or multi-GB file — oversized (>2 MiB) settings files now fail at startup with a clear error.
  • Scheduled tasks refusing their own configured prompt as untrusted input — the fired prompt is now delivered as the session’s assigned task.
  • Plugins enabled via the --settings CLI flag not loading (regression since v2.1.181) — fixed.
  • /ultrareview refusing to run in repos with no merge base — it now offers to review all tracked files.
  • claude update and claude doctor hanging silently, and the /status System diagnostics section going blank, when a shell-config path is a directory — fixed.
  • Memory frontmatter values being silently truncated at an inline # when memory files are saved — fixed.
  • A spurious “check your network” warning that appeared while the advisor was thinking — fixed.
  • Hooks with exit code 2 not blocking as documented when the hook’s stdout JSON fails schema validation — fixed.
  • MCP transient errors during prompts/resources refresh clearing the server’s slash commands and resources — fixed.

Notes

  • If you use permission rules, re-verify behavior — single-segment dir/** allow rules now apply only to <cwd>/dir instead of the whole tree. Write **/dir/** for any-depth matching. deny/ask rules keep their any-depth match.
  • Bash permission checks are more conservative — commands over 10,000 characters, zsh subscripts/modifiers in [[ ]], file-descriptor redirect forms, and certain help/man commands now prompt instead of running automatically. Commands that were previously auto-approved may now ask for confirmation.
  • docker permission change — docker/Podman commands carrying daemon-redirect flags (--url, --connection, --identity, Podman’s remote mode) now require permission. Automation scripts using these flags may need permission-rule adjustments.
  • EndConversation is an existing claude.ai safeguard — it’s new to Claude Code, but it has been applied to highly abusive users and jailbreak attempts on claude.ai since 2025.