Claude Code 2.1.212: /fork Now Goes Background, and Runaway Loops Finally Have a Ceiling

Claude Code 2.1.212 shipped today. It is a big one, roughly sixty lines of release notes. Here is what actually changes how you work.

/fork no longer does what you think

This is the most structural change, and it is easy to miss.

/fork used to spawn a subagent inside your session. Now it copies your conversation into a new background session, with its own row in claude agents, while you keep working in the current one.

The old behaviour still exists, it just has a new name: /subtask.

If you have habits or notes saying “fork to delegate without leaving my session”, they are stale. The new reflex: /subtask to delegate in-session, /fork to duplicate the conversation and branch off in parallel.

Small related bonus: when a session has no title, /fork names the copy after your prompt, so the row stays recognizable in the agent view.

Runaway loops now have a ceiling

Two new guardrails, both defaulting to 200:

Web searches: session-wide limit, tunable via CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION.
Subagent spawns: per-session cap, override with CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION. A /clear resets the budget.

The stated goal is to stop runaway search and delegation loops. If you have ever watched a session burn tokens looping through a chain of agents, you know exactly why this exists.

Worth noting: 200 is high. These caps are not there to constrain your daily work, they are there to prevent the disaster scenario. If you want a real safety net, lower the value yourself.

Slow MCP calls stop blocking your session

MCP tool calls running longer than 2 minutes now move to the background automatically, so the session stays usable. The threshold is configurable, or can be disabled, via CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS.

If you wire up slow MCP servers (scraping, third-party APIs, heavy imports), this is the line that changes your life.

The security fix you should not skim

Two fixes deserve a careful read if you run unattended:

Plan mode was auto-running file-modifying Bash commands (think touch, rm) without a permission prompt or an SDK canUseTool callback. Plan mode is supposed to be read-only. It was not.
Worktree creation followed a repository-committed symlink at .claude/worktrees, which could create files outside the repository.

Both are fixed in 2.1.212. If you rely on plan mode as a safety barrier, that alone justifies updating today.

The rest, usefully condensed

/resume in the agent view now opens a picker of past sessions, including ones deleted from the list, and resumes your pick as a background session.
claude auto-mode reset restores the default auto-mode configuration, with a confirmation prompt (--yes to skip).
The Task tool’s mode parameter is deprecated and now ignored: subagents inherit the parent session’s permission mode.
Windows: /background and claude --bg no longer fail with uv_spawn errors when Group Policy blocks PowerShell 5.1. The daemon now prefers PowerShell 7.
Prompt caching finally works behind LLM gateways and custom base URLs (Bedrock, Vertex, 1P).
SendMessage no longer duplicates its body into replayed history and tool results, cutting token usage in inter-agent messaging.
Conversations with many images no longer fail incorrectly with “Request too large”, and the error message now explains the real cause.

Should you update

Yes, and right away if you use plan mode, worktrees, or slow MCP servers. The plan mode permission hole is reason enough on its own.

For everything else, the one to remember is the /fork change: it is the only one that breaks an existing reflex.

Source: official Claude Code changelog.