Claude Code 2.1.218: /code-review moves to the background, /deep-research stops launching itself

Claude Code 2.1.218 shipped on July 22. About thirty fixes, but the release is really about three behavior changes that will trip up existing habits. Here’s what matters.

/code-review now runs in the background, /deep-research stops firing on its own

Two commands got a default-behavior overhaul.

• /code-review now runs as a background subagent. The review no longer fills up your active conversation, and a stack of slash commands becomes its review target. If you were used to seeing results print inline, the flow looks different now.
• /deep-research only starts when you invoke it explicitly. Claude no longer kicks it off on its own initiative. If you were relying on that auto-trigger for deep dives, you’ll need to type the command yourself from now on.

Two related fixes ship in the same batch: /code-review ultra no longer silently falls back to a local review in non-interactive sessions (it launches the cloud review as intended), and /ultrareview no longer chokes on a descriptive argument like “review my auth changes”: it runs a review of your current branch and keeps your text as a note attached to the findings.

One more change if you author skills: skills declared with context: fork now run in the background by default. Set background: false in the skill’s frontmatter to keep the old behavior.

Security: agent hooks can no longer run from an untrusted folder

A hook defined in an agent file’s frontmatter could execute even if the folder holding that file had never been approved. That’s fixed: the hook now requires the agent file’s own folder to have explicitly accepted workspace trust. If you open agents shared or cloned from outside sources, this closes a real door.

Two related tightenings:

• Agent names containing : are now rejected, since that character is reserved for plugin namespacing. If one of your custom agents uses it, rename it before you update.
• Trust dialogs now name the actual repository root a grant covers, instead of staying vague about what’s being approved.

Auto mode gets quieter on permissions

Auto mode’s classifier now handles several checks that used to always pop a dialog: dangerous rm commands, backgrounding with &, suspicious Windows paths, and, in plan mode, Bash commands the static analyzer can’t prove are read-only. Fewer interruptions if you run in auto mode, but the call is now made by a classifier instead of a fixed deterministic rule, worth keeping an eye on if you’re on a sensitive machine.

An actual UX fix: left arrow no longer trashes your conversation

Pressing left arrow mid-edit could discard the active conversation with no way back. Now a press right after an edit asks for confirmation, and Esc in the agent view sends you back to the backgrounded conversation instead of losing it.

Everything else worth knowing

• Windows paths with a \u-prefixed segment (like C:\Users\unicorn) were getting mangled into CJK characters in tool inputs, making those files inaccessible. Fixed.
• claude mcp list and /mcp now show the HTTP status and error text when an MCP server fails to connect, plus a warning when a config value has hidden leading or trailing whitespace.
• A retry loop that kept resending the same doomed request after a context-overflow error with a large thinking budget: fixed.
• Fork-session lineage getting lost after compaction in headless and SDK sessions: fixed.
• A resumed session failing on every turn, or crashing on resume, because of a malformed attachment entry in its history: fixed.
• Pull request events occasionally lost when a session exited right after creating or linking a PR.

Should you update

Yes, but read the first two sections first if you’ve built automation around /code-review, /deep-research, or custom agents with a : in their name: these are behavior changes, not plain bug fixes. Beyond that, nothing here is urgent enough to hold off on updating.

Source: official Claude Code changelog.