Claude Code v2.1.210: Worktree Isolation & Bug Fixes

Anthropic released Claude Code v2.1.210 with a heavy focus on bug fixes and security hardening. The release addresses subagent isolation leaks, a false ultracode trigger, permission deprecations, and several session/crash issues.

Key Fixes

Worktree isolation: Fixed isolation: 'worktree' subagents being able to run git-mutating commands against the main repo instead of their own isolated worktree. This is a security fix — subagents should only affect their sandbox.
Ultracode opt-in: Fixed the ultracode keyword accidentally firing on non-human input like webhook payloads and relayed PR comments. It now only triggers from direct user messages.
Paste markers: Fixed stray È/É characters leaking into external editors — paste markers are no longer transmitted.
Background workers: Fixed crash-looping when a client resets its connection to the background service.
Plan approvals: Fixed approvals without edits being labeled "(edited by user)" and overwriting the plan file with a stale snapshot.
Positional placeholders: Unmatched $1/$2 in skills and commands are now preserved verbatim instead of being silently stripped.
Git worktree locks: Killed background sessions no longer leave a permanent git worktree lock. The periodic sweep now releases locks whose owning process is gone.
cd backgrounding: When a cd command is moved to the background, the tool result now correctly states the working directory is unchanged.
SDK MCP servers: Fixed initialize control request waiting until the next turn to start connecting. Connects immediately.
MCP server teardown: Plugin-provided MCP servers are no longer torn down when MCP servers are re-synced mid-session.

New Features

Live elapsed-time counter: The collapsed tool summary line now shows a ticking counter for long-running tool calls, so you can see progress instead of a frozen UI.
Permission rule warnings: On startup, a warning is printed for Write(path), NotebookEdit(path), and Glob(path) permission rules — use Edit(path) or Read(path) instead.
Auto mode improvements: The permission classifier now defaults to Sonnet 5 for external sessions, validated on the first request and pinned for the session.
Memory write overflow: Writes that leave a MEMORY.md index over its read limit now produce an explicit error instead of silent truncation.
Screen reader: Announces permission mode changes aloud when cycling with Shift+Tab.
Agents footer: Shows how many background agents are waiting on your input, with brief color emphasis on count change.

Improved Prompt Injection Hardening

The Agent tool is now hardened against indirect prompt injection via content a subagent reads. This reduces risk from untrusted content in subagent sessions.

Other Fixes

claude attach no longer fails with "job not found" or "agent still starting"; it waits for the daemon to settle, and terminal resizes during a slow attach are applied once complete.
Session crash fixed when a tool's result renderer returned a bigint or plain text instead of a UI element.
Hook callback timeout no longer misreported as a user rejection.
Grep content mode no longer claims "No matches found" when paginating past the end of results.
claude agents --effort ultracode now reaches dispatched sessions.
Pressing ← to open agents view no longer drops the task tracker when returning.
Agents dashboard no longer retains pasted images from abandoned reply drafts.
Returning to agents view from a session leaves no overlapping ghost frames with CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1.
Late-appearing .claude/* symlinks now reconciled into sandbox deny-write list.
Plugin cache writes no longer leave temp files behind on failure, and locked-file renames work on Windows and network filesystems.
/doctor now proposes auto-mode default on Bedrock, Vertex, and Foundry (auto mode no longer needs opt-in there).
Fable advisor temporarily hidden due to server-side issue.