Claude Code 2.1.216: Symlink Security Holes Patched, and Long Sessions Finally Stop Crawling

Claude Code 2.1.216 shipped on July 20. About forty fixes, several of them touching security and long-session reliability directly. Here is what deserves your attention.

The security fixes you should not skim

Three holes worth a careful read:

Writes escaping the project through a symlink. Workflow saves and scheduled-task writes followed a symlink placed at .claude, which could redirect the write outside the repository. Fixed.
Worktree isolation bypass. A subagent isolated in a worktree could redirect git into the shared checkout via git -C, --git-dir, or the GIT_DIR/GIT_WORK_TREE environment variables. Isolation was supposed to prevent that. It did not.
Read-only commands on Windows accessing network paths without a permission prompt.

Two more permission-checking hardenings ship alongside these: detection of compound Bash commands with redirects inside && lists or negations, and PowerShell validation against invisible Unicode characters slipped into a command.

If you run unattended or share worktrees between agents, these five lines alone justify updating.

Background sessions get their identity back

A subtler bug than a flashy one: resuming a background agent session used to silently revert it to the default agent, dropping the original agent’s prompt and tool restrictions along the way. If you had launched a deliberately restricted agent, it came back from resume without its guardrails. Fixed: the prompt and restrictions are now restored.

Two more worktree bugs fixed in the same release:

A session could land in the leftover worktree from another project when the working directory did not match the selected project.
Background sessions whose worktree has no git repository became impossible to delete.

And on the daemon side: claude daemon stop --any could kill an unrelated process because of a stale lockfile left by an old daemon.

Long sessions: the quadratic slowdown is fixed

The real workflow fix in this release. In long sessions, message normalization cost grew quadratically with the number of turns, causing multi-second stalls and slow resumes. If you have ever waited long seconds for a multi-hour session to come back after a resume, this was probably why. Fixed.

A new sandbox setting

sandbox.filesystem.disabled lets you turn off filesystem isolation while keeping network egress control. Useful if you want the sandbox’s network safety net without its file constraints.

The rest, usefully condensed

AskUserQuestion no longer pushes Claude to continue when your free-text answer explicitly asked it to wait or explain further.
Claude Code on the web no longer re-asks the same question and drops your answer after the session sat idle for a few minutes.
Skills and commands changed mid-session now show up in the slash menu without a restart.
MCP re-authentication no longer revokes working credentials before the new sign-in actually succeeds.
Pressing Ctrl+X twice in the agent list now reliably deletes the session.
Cloud sessions whose container restarts mid-turn no longer drop the in-flight message: the interrupted turn now re-runs on resume instead of leaving the session stuck.

Should you update

Yes, without delay if you use worktrees shared between agents, scheduled tasks, or long-running sessions. The symlink and git-isolation security fixes alone are reason enough not to wait.

Source: official Claude Code changelog.