Release archive

Claude Code v2.1.216: New sandbox.filesystem.disabled Setting, a Long-Session Slowdown Fix, and Worktree Isolation Fixes

Claude Code v2.1.216 adds the sandbox.filesystem.disabled setting, fixes a quadratic slowdown in long sessions, stops worktree-isolated subagents from reaching the shared checkout, and improves /context and /rewind.

• 10 min read • By ClaudeWorld

Claude Code v2.1.216 is a large release with 40 changelog entries. It adds a sandbox.filesystem.disabled setting, fixes a slowdown in long sessions where message normalization cost grew quadratically with the number of turns, and closes several permission and worktree-isolation gaps. Other changes improve /context, /rewind, background sessions, and several error messages.

What’s New

sandbox.filesystem.disabled Setting

The new sandbox.filesystem.disabled setting skips filesystem isolation while keeping network egress control.

/context Overflow Warning

/context now shows an explicit warning when the conversation exceeds the context window, and a failed /compact now displays as an error.

/rewind no longer restores or deletes files through symlinks or hard links at tracked paths, and it reports how many paths it skipped.

Clearer /fork Confirmation

The /fork confirmation is now a single line with the new session’s name, its claude attach id, and a note when the copy shares your checkout.

Background Sessions Park /mcp and /install-github-app Requests

In background sessions with no client attached, /mcp and /install-github-app now park a “needs input” request in the agent view.

More Informative Review and Spend-Limit Messages

The /ultrareview diff-too-large error now shows configured limits, the measured diff size, and the largest contributing files. The /code-review ultra empty-diff message names the exact base ref and suggests passing an explicit base, and the spend limit adjustment prompt shows the server’s reason when a spend limit change is rejected.

Fixes and Improvements

  • Performance: Long sessions no longer slow down from message normalization cost growing quadratically with the number of turns, which had caused multi-second stalls and slow resumes.
  • Worktree isolation and file safety: Worktree-isolated subagents can no longer redirect git into the shared checkout via git -C, --git-dir, or GIT_DIR/GIT_WORK_TREE. Workflow saves and scheduled-task writes no longer follow a symlink at .claude, which could redirect writes outside the project.
  • Permission checks: Bash permission checking is fixed for compound statements with redirects inside && lists or negations. On Windows, read-only commands no longer access network paths without a permission prompt. The PowerShell tool’s permission validation is fixed for commands containing invisible Unicode characters, and its validation of git and gh command arguments is improved.
  • Auto mode: Auto mode no longer denies commands with “HTTP 401” classifier errors after the OAuth token expires or rotates mid-session.
  • AskUserQuestion: AskUserQuestion no longer tells Claude to continue when your answer asked it to wait or explain first; free-text answers now get neutral wording.
  • Web and cloud sessions: Claude Code on the web no longer re-asks the same question and drops your answer after the session sits idle for a few minutes. Cloud sessions no longer drop the in-flight message when the session’s container restarts mid-turn; the interrupted turn now re-runs on resume instead of leaving the session unresponsive.
  • Background agents: Resumed background agent sessions no longer revert to the default agent; the agent’s prompt and tool restrictions are now restored. Background subagents are no longer cancelled when a high-priority message arrives during their startup window, and pressing Ctrl+X twice in the agent list now deletes the session, without deleted sessions reappearing when their background worker has died.
  • Worktrees: Worktree sessions no longer land in another project’s leftover worktree when the working directory does not match the selected project.
  • Daemon: claude daemon stop --any can no longer terminate an unrelated process via a stale legacy daemon lockfile.
  • MCP: Re-authenticating an MCP server no longer revokes working credentials before the new sign-in succeeds, and the reconnect needs-auth message in background sessions no longer points at an unusable command.
  • Skills and commands: Skills and commands changed during a session now appear in the slash menu without a restart.
  • Telemetry: The Prometheus metrics endpoint (OTEL_METRICS_EXPORTER=prometheus) no longer emits invalid # UNIT lines.
  • VS Code: Right-to-left text (Arabic, Hebrew, Persian) no longer renders in the wrong order when mixed with English or code.

This release contains 40 changes in total; see the full changelog for every item.

How to Update

  1. Check your installed version: claude --version
  2. Update in place: claude update
  3. Note that /rewind no longer restores or deletes files through symlinks or hard links at tracked paths, and it reports how many paths it skipped.