Claude Code v2.1.207: Auto Mode GA, Terminal Freeze Fix, and Security Hardening

Anthropic just dropped Claude Code v2.1.207 — a release packed with fixes and one major change: Auto mode is now generally available on Bedrock, Vertex AI, and Foundry without the CLAUDE_CODE_ENABLE_AUTO_MODE opt-in flag. You can disable it via disableAutoMode in settings. Also, the default model on these platforms has been bumped to Claude Opus 4.8.

Key Bug Fixes

• Terminal freeze fixed — streaming responses containing long lists, tables, paragraphs, or code blocks no longer freeze the terminal or lag keystrokes.
• Security consent dialog — remote managed settings from non-interactive runs (claude -p, SDK) are no longer silently recorded as consented without showing the prompt.
• False prompt-injection warnings — benign system-generated conversation updates no longer trigger spurious alerts.
• Auto-updater — no longer overwrites custom launcher scripts or symlinks at ~/.local/bin/claude. Run /doctor to detect an externally managed launcher.
• Compound commands with cd — no longer prompt for permission when the only output redirect is /dev/null.
• Transcript jump — fixed the view jumping above the answer start when streaming finishes.
• Git worktree config — extensions.worktreeConfig no longer leaks into .git/config after removing the last worktree, which broke go-git tools like tea.
• Malformed bracket patterns — in rules globs, skill paths, .ignore, and .worktreeinclude no longer break file reads, suggestions, or worktree creation.
• Agent team crash loop — malformed teammate mailbox messages no longer cause repeated errors every second.
• Background sessions — auto-named by plan acceptance now show the name on the agent-view row; worktree sessions no longer resume blank after cold reopen.
• Remote Control — task status updates are preserved after network interruption or credential refresh; desktop-hosted sessions now show background agent and workflow progress on mobile/web.
• Deep research — Fetch-phase agents are now labeled by source hostname instead of "unknown".
• Bedrock SSO — no longer requests fresh AWS SSO credentials on every API request.
• Windows — indefinite hang during AWS credential resolution (e.g., a stuck credential_process) now respects the 60-second stall guard.
• /usage-credits — malformed values (e.g., pasted timestamps) are now rejected with an error, and amounts over $1,000 require typed confirmation.

Security Fixes: Plugin Shell Injection

Plugin hooks, monitors, and MCP headersHelper now reject ${user_config.*} in shell-form commands — this was a shell injection vector. If you use shells in hooks, switch to exec form (args array) or read the value via $CLAUDE_PLUGIN_OPTION_<KEY>. For monitors and headersHelper, read the value inside the script from the config file or the server's env block.

Additionally, plugin option values (pluginConfigs) are no longer read from project-level .claude/settings.json — only user, --settings, and managed settings are honored.

Behavior Changes

• Auto mode config — no longer reads autoMode from .claude/settings.local.json (repo-resident). Use ~/.claude/settings.json instead.
• Agent view — pasting the same text again expands the collapsed [Pasted text #N] placeholder instead of adding a second one. Blocked session peeks now show a worded staleness clock (e.g., waiting 3m) instead of duplicate timestamps.

Who This Affects

Anyone using Claude Code on Bedrock, Vertex AI, or Foundry — Auto mode is now the default. Plugin developers should audit their hooks for shell injection. All users should update to avoid terminal freezes, credential storms, and stealth consent issues.