Claude Code v2.1.210: Live Elapsed-Time Counter, Permission Rule Warnings, and a Worktree Isolation Fix

Claude Code v2.1.210 is a fix-heavy release with 33 changelog entries. It adds a live elapsed-time counter for long-running tool calls and a startup warning for permission rules that should use Edit(path) or Read(path) instead. Several fixes tighten safety around worktree-isolated subagents, the ultracode keyword, and prompt injection, alongside improvements to background sessions, MCP, and the agents view.

What’s New

Live Elapsed-Time Counter

The collapsed tool summary line now includes a live elapsed-time counter, so long-running tool calls visibly tick instead of looking stuck.

Startup Warning for `Write(path)`, `NotebookEdit(path)`, and `Glob(path)` Rules

Claude Code now shows a startup warning for Write(path), NotebookEdit(path), and Glob(path) permission rules. Use Edit(path) or Read(path) instead.

Auto Mode Classifier Defaults to Sonnet 5 for External Sessions

In auto mode, the permission classifier now defaults to Claude Sonnet 5 for external sessions. The choice is validated on the session’s first request and pinned for the session.

Agents View Updates

The agents footer hint now shows how many background agents are waiting on your input, with a brief color emphasis when the count changes. In the agent view, the session you pressed ← from stays visibly marked even after mouse hover or arrow keys move the selection.

Screen reader mode now announces permission mode changes aloud when you cycle modes with Shift+Tab.

Fable Temporarily Unavailable in the Advisor Picker

Fable temporarily shows as unavailable in the advisor picker while a server-side issue causing Fable advisor failures is fixed.

Fixes and Improvements

Security: isolation: 'worktree' subagents can no longer run git-mutating commands against the main repo checkout instead of their own isolated worktree. The ultracode keyword opt-in no longer fires on non-human-originated input such as webhook payloads and relayed PR comments. The Agent tool is hardened against indirect prompt injection via content a subagent read, and late-appearing .claude/* symlinks are now reconciled into the sandbox deny-write list.
Hooks and shell tools: A hook callback timeout is no longer misreported to the model as a user rejection, which had made unattended sessions stop and wait. When a command is moved to the background, the tool result now states that the working directory is unchanged, so Claude no longer assumes a cd took effect. The Bash/PowerShell tool message for a command that hits its timeout and is auto-backgrounded now lets the model distinguish a hang from an explicit background request.
Background sessions: claude attach no longer sometimes fails with “job not found” or “agent is still starting” during session transitions; it now waits for the daemon to settle and applies terminal resizes once a slow attach completes. Background workers no longer crash-loop when a client resets its connection to the background service, killed background sessions no longer leave a permanent git worktree lock behind, and claude agents --effort ultracode now reaches dispatched sessions instead of being silently dropped.
MCP: Plugin-provided MCP servers are no longer torn down when MCP servers are re-synced mid-session, and SDK MCP servers registered via an initialize control request no longer wait until the next turn to start connecting.
Plans: Plan approvals without edits are no longer labeled “(edited by user)” and no longer overwrite the plan file with a stale snapshot.
/doctor: /doctor no longer skips its auto-mode-default proposal on Bedrock, Vertex, and Foundry, where auto mode no longer needs an opt-in.
Skills and commands: Unmatched $1/$2 positional placeholders are no longer silently stripped; they are now preserved verbatim.
Memory: Memory writes that leave a MEMORY.md index over its read limit now produce an explicit error instead of silent truncation.
Grep: Content mode no longer claims “No matches found” when paginating past the end of results.
Plugins: Plugin cache writes no longer leave temp files behind on failure or fail on locked-file renames on Windows and network filesystems.
External editors: Paste markers no longer leak into external editors opened from Claude Code, where they could appear as stray È/É characters around pasted text.

This release contains 33 changes in total; see the full changelog for every item.

How to Update

Check your installed version: claude --version
Update in place: claude update
If your permission rules use Write(path), NotebookEdit(path), or Glob(path), Claude Code now warns about them at startup; use Edit(path) or Read(path) instead.