Claude Code v2.1.205: Transcript Tampering Blocked, JSON Schema Fixes, and Auto-Mode Improvements

Claude Code v2.1.205 ships with a mix of security hardening, bug fixes, and UX improvements. The release is available immediately from the GitHub releases page.

Security and Auto-Mode Improvements

• Added an auto mode rule that blocks tampering with session transcript files — prevents malicious modifications during automated sessions.
• Improved auto mode to ask before running rm -rf on a variable it cannot resolve from context, reducing accidental deletions.

JSON Schema Fixes

Two fixes for --json-schema: invalid schemas no longer silently produce unstructured output (they will error properly), and schemas using the format keyword are no longer incorrectly rejected.

Background Agents and Jobs

• Fixed background agents staying shown as "failed" or "completed" in the agent list after being resumed with SendMessage.
• Fixed background jobs flipping from "needs input" back to "working" when the agent's turn contained no readable text.
• Fixed claude attach erroring when a background agent was mid-upgrade restart — now it waits for the agent to come back.
• Fixed session-to-PR linking missing a PR created in a Bash call whose output exceeded the 30K inline limit.

Platform-Specific Fixes

• Windows: fixed worktree removal deleting files outside the worktree when an NTFS junction or directory symlink existed inside it.
• Windows: fixed a crash when the directory Claude was launched from is deleted, locked, or unmounted while a command is running.
• Fixed a crash when a file watcher was closed while a directory scan was still in flight.

MCP and Plugin Fixes

• Fixed claude mcp add-from-claude-desktop getting stuck when a server name contains unsupported characters — invalid names are now reported and remaining servers still import.
• Reserved the "Claude Browser" MCP server name (alongside "Claude Preview"); user-configured MCP servers can no longer register under either name.
• Fixed a plugin LSP server that fails to initialize preventing a valid LSP server from another plugin handling the same file extension.

Agent View and Notifications

• Improved agent view: sessions that edit, merge, comment on, or push to an existing PR now link it in claude agents.
• Improved agent view: rows now show a colored state word and a classifier-written headline instead of raw tool call text, and the peek opens with full status including the exact ask for blocked sessions.
• Fixed the agent view rendering one line too high and clipping its header when the job list slightly overflowed the screen.
• Background task notifications now explicitly state that no human input has occurred, preventing fabricated in-transcript approvals from being acted on.

Performance and Misc

• Auto-update binary downloads now stream to disk instead of buffering in memory, cutting the updater's peak memory usage by roughly 400 MB.
• /doctor is now a full setup checkup that can diagnose and fix issues; /checkup is its alias.
• Fixed Cowork VM-mode local-agent sessions failing to start with "Not logged in · Please run /login" on CLI 2.1.203+.