claudekit / updates / claude-code-2-1-216
[ PATCH · ]

Claude Code 2.1.216

A new sandbox.filesystem.disabled setting skips filesystem isolation while keeping network egress control. A slowdown in long sessions — where message normalization cost grew quadratically with the number of turns, causing multi-second stalls and slow resumes — is fixed, along with worktree-isolated subagents redirecting git into the shared checkout via git -C, --git-dir, or GIT_DIR/GIT_WORK_TREE, and workflow saves and scheduled-task writes following a symlink at .claude that could redirect writes outside the project. A large batch of session, permission, and worktree regressions also lands, including auto mode denying commands with HTTP 401 classifier errors after the OAuth token rotated mid-session and AskUserQuestion acting against your answer's intent.

Claude Code
Official announcement →

This article is a summary based on official documentation.

What changed

Claude Code 2.1.216 shipped on July 20, 2026. A new sandbox setting lets you skip filesystem isolation alone, and an accumulating slowdown in long sessions is cleaned up. Worktree-isolation and background-agent regressions, a security fix for writes escaping the project through a .claude symlink, and a large batch of auto-mode, permission-checking, and command-parsing bugs all land.

New features

  • New sandbox.filesystem.disabled setting

    The sandbox tied filesystem isolation and network egress control together, so relaxing file-access restrictions meant turning off the whole sandbox. The new sandbox.filesystem.disabled setting skips filesystem isolation while keeping network egress control in place.

Key improvements

  • Fixed long-session slowdown

    As conversations grew, message normalization cost grew quadratically with the number of turns, causing multi-second stalls and slow resumes. The normalization path was reworked to remove that lag.

  • One-line /fork confirmation

    The /fork confirmation spread its details across several lines. It’s now one line showing the new session’s name, its claude attach id, and a note when the copy shares your checkout.

  • /context context-window warning and failed /compact display

    A conversation exceeding the context window gave no explicit warning, and a failed /compact was hard to spot. /context now shows an explicit warning when the conversation exceeds the context window, and a failed /compact displays as an error.

  • /rewind symlink and hard-link protection

    /rewind could restore or delete files through symlinks and hard links at tracked paths. It no longer restores or deletes files through symlinks or hard links, and reports how many paths it skipped.

  • Clearer /ultrareview and /code-review ultra diff messages

    A diff that was too large or empty gave little explanation. The /ultrareview diff-too-large error now shows configured limits, measured diff size, and largest contributing files, and the /code-review ultra empty-diff message names the exact base ref and suggests passing an explicit base.

  • Spend-limit prompt shows the server’s reason

    A rejected spend-limit change gave no reason. The spend limit adjustment prompt now shows the server’s reason when a change is rejected.

  • Background sessions park a “needs input” request

    In background sessions with no client attached, /mcp and /install-github-app had nowhere to send their input request. They now park a “needs input” request in the agent view when no client is attached.

  • Updated bundled dataviz skill

    The default chart palette was reordered, and guidance that suggested direct labels for four-series charts was fixed.

Bug fixes

Sessions & resilience

  • Cloud sessions dropping the in-flight message when the session’s container restarts mid-turn — the interrupted turn now re-runs on resume instead of leaving the session unresponsive.

Permissions & command parsing

  • Auto mode denying commands with “HTTP 401” classifier errors after the OAuth token expired or rotated mid-session — fixed.
  • Bash command permission checking for compound statements with redirects inside && lists or negations — fixed.
  • Read-only commands on Windows accessing network paths without a permission prompt — fixed.
  • Bash command parsing of non-ASCII characters not matching real shell word boundaries — fixed.
  • PowerShell tool permission validation of commands containing invisible Unicode characters — fixed, and validation of git and gh command arguments was improved.

Interaction & prompts

  • AskUserQuestion telling Claude to continue even when your answer asked it to wait or explain first — free-text answers now get neutral wording.
  • Claude Code on the web re-asking the same question and dropping your answer after the session sat idle for a few minutes — fixed.
  • @-mentions silently attaching nothing after file-modifying hooks, vim dot-repeat of c-operators and paste, statusline running twice on resume, and resume-picker hangs on failure — fixed.
  • Esc-Esc at an idle prompt not opening the rewind picker in long-running sessions with background tasks — fixed.

Background agents & worktrees

  • Resumed background agent sessions reverting to the default agent — the agent’s prompt and tool restrictions are now restored.
  • Worktree-isolated subagents redirecting git into the shared checkout via git -C, --git-dir, or GIT_DIR/GIT_WORK_TREE — fixed.
  • Worktree sessions landing in another project’s leftover worktree when the working directory did not match the selected project — fixed.
  • Background sessions whose worktree has no git repository being undeletable — fixed.
  • Pressing Ctrl+X twice in the agent list failing to delete a session, and deleted sessions reappearing when their background worker had died — fixed.
  • Background subagents getting cancelled when a high-priority message arrives during their startup window — fixed.
  • claude daemon stop --any potentially terminating an unrelated process via a stale legacy daemon lockfile — fixed.

Auth, connections & security

  • Workflow saves and scheduled-task writes following a symlink at .claude, which could redirect writes outside the project — fixed.
  • Claude-in-Chrome 403-looping on reconnect when the session’s OAuth token lacks a required scope — fixed.
  • MCP re-authenticate revoking working credentials before the new sign-in succeeds, and the reconnect needs-auth message in background sessions pointing at an unusable command — fixed.

Skills, commands & telemetry

  • Skills and commands changed during a session not appearing in the slash menu until restart — fixed.
  • Plugin skills with a name frontmatter field losing their plugin prefix in slash-command autocomplete — fixed.
  • Telemetry misreporting permission denials — failed permission-prompt requests no longer count as user rejections, and user interrupts are now reported as user aborts instead of rejections.
  • The Prometheus metrics endpoint (OTEL_METRICS_EXPORTER=prometheus) emitting invalid # UNIT lines — fixed.

Terminal & display

  • Mouse and focus garbage in the terminal while a GUI editor from /memory, /plan, /keybindings, or Ctrl+G is open — fixed; /memory no longer waits for the editor to close.
  • Dialogs in fullscreen mode stretching past the right-hand edge of their panel, and the /config settings list clipping its keyboard-hint footer — fixed.
  • The transcript-mode (Ctrl+O) footer hint wrapping on terminals narrower than 104 columns — fixed.
  • [VS Code] Right-to-left text (Arabic, Hebrew, Persian) rendering in the wrong order when mixed with English or code — fixed.

Notes

  • sandbox.filesystem.disabled only relaxes file isolation — network egress control stays in place, so you can lift file-access restrictions without turning off the whole sandbox.
  • Teams using worktree-isolated subagents should re-verify behavior — paths that reached the shared checkout via git -C, --git-dir, or GIT_DIR/GIT_WORK_TREE are now closed, and worktree sessions no longer land in another project’s leftover worktree on a mismatched working directory.
  • Writes escaping the project through a .claude symlink are now blocked — workflow saves and scheduled-task writes no longer follow a .claude symlink, and /rewind no longer restores or deletes through symlinks or hard links. Check behavior if your setup relies on symlinks.
  • Auto mode’s OAuth-expiry denials are resolved — commands denied with “HTTP 401” after a token expired or rotated mid-session are fixed, so auto mode is more reliable in long-running sessions.