Claude Code v2.1.218 Fixes /code-review, MCP Auth, Windows Path Corruption
Claude Code v2.1.218 is out with a laundry list of fixes and improvements. The headline change: /code-review now runs as a background subagent, keeping your main conversation clean and allowing stacked slash commands to target the review context.
Key Fixes
- Windows path corruption fixed: Paths with
\usegments (e.g.,C:\Users\unicorn) were being misinterpreted as CJK unicode escapes, making files inaccessible. No longer. - Left arrow accidental data loss: Pressing left arrow after editing now asks for confirmation; Esc in the agent view returns to the backgrounded conversation.
- MCP connectivity:
claude mcp listand/mcpnow show HTTP status and error text when a server fails to connect. Hidden leading/trailing whitespace in MCP config values also triggers a warning. - Multi-line paste with
j: Terminals that encode pasted newlines as Ctrl+J no longer collapse multi-line pastes into a single line withjin place of newlines. - /ultrareview with descriptive args: Calling
/ultrareview review my auth changesnow works correctly, running a review of the current branch with the text applied as a note. - /code-review ultra in non-interactive: No longer silently falls back to local review; now launches the cloud review as expected.
Improvements
- Auto mode refinements: Dangerous-rm, background-& and suspicious-Windows-path checks no longer open permission dialogs—the auto-mode classifier handles them. Plan mode with auto similarly delegates bash read-only analysis to the classifier instead of prompting.
- /deep-research manual only: Claude will no longer autonomously start a deep research session; it must be invoked manually.
- Trust dialogs: Now name the repository root the grant covers.
Accessibility & Reliability
- Screen-reader announcements for word/line deletions in
--ax-screen-readermode. VoiceOver no longer reads "new line" for typed spaces. - Fix for deeply nested watched directory deletions causing stack-overflow crashes.
- Monotonic clock timers to prevent negative turn durations after system clock adjustments.
- Resume sessions no longer crash from malformed delta attachments.
- Fork-session lineage preserved after compaction in headless/SDK sessions.
Other Notables
- Bedrock wizard: Assumes-role profiles in partitioned AWS regions and proxy-only networks now pass verification.
- Gateway metering: Bedrock application-inference-profile ARNs are priced at the configured model's rates.
- Prompt history: Race conditions causing dropped or duplicated history entries resolved.
- Retry loop fix: Identical doomed requests after context-overflow with large thinking budget no longer loop. Ctrl+B backgrounding gets the same caps as other paths.
📖 Read the full source: GitHub Claude-Code
👀 See Also
Reddit discussion highlights debugging challenges with AI-generated code
A Reddit discussion on r/ClaudeAI details specific issues developers face with AI-generated code, including security vulnerabilities, logic hallucinations, and debugging that can take longer than writing code manually.
Claude Code Opus 4.6 Now Defaults to 1M Token Context Window
Claude Code's Opus 4.6 model now comes with a 1 million token context window by default, maintaining the same pricing as previous versions. This change appears to be live without an official announcement.
Developer's Dilemma: National Security Concerns Limit Open Model Choices
A developer working with security-sensitive clients reports being forced to choose between outdated U.S. open models like gpt-oss-120b or more capable Chinese models like GLM and MiniMax, which clients reject as national security risks.
70% of devs say AI code has more vulns; 30% ship it anyway — Checkmarx survey
70% of developers believe AI-generated code has significantly more vulnerabilities, yet 30% knowingly ship vulnerable code into production. The Checkmarx survey of 2,350 respondents also finds 93% of orgs suffered security breaches from vulnerable apps.