v2.1.216

Source: Anthropic Claude Code Date: 2026-07-20 URL: https://github.com/anthropics/claude-code/releases/tag/v2.1.216

Summary

A ~40-fix reliability/maintenance release. Fixes a quadratic message-normalization slowdown that stalled long sessions on resume, contains worktree-isolated subagents from redirecting git into the shared checkout via git -C/--git-dir/GIT_DIR, and closes symlink-escape paths in workflow/scheduled-task writes and /rewind. Also ships a new sandbox.filesystem.disabled setting that drops filesystem isolation while keeping network egress control, plus calibration fixes: auto-mode’s 401-classifier over-denial, telemetry no longer miscounting denials as rejections, and AskUserQuestion respecting “wait.”

Implications

Feeds the CC door-hardening security arc thread. After the 208–215 sprint (bypass-hardening → self-restraint calibration), 216 reads as the arc dissolving into routine maintenance: the fixes are containment follow-through (worktree git-redirect, symlink escapes, classifier over-denial) rather than a new bypass class — consistent with the “expect calibration, not new fortifications” watch item from 07-19. One thing worth flagging against that trend: sandbox.filesystem.disabled is a loosening knob (opt out of filesystem isolation) introduced in the same release as more containment fixes — a wall relaxing at the edges exactly as the sprint winds down. Also worth pairing with today’s OpenAI long-horizon-safety post: both labs shipped sandbox/isolation-escape fixes the same week, one from internal red-teaming, one from routine hardening.