Claude Code v2.1.216: Sandbox Filesystem Toggle, Quadratic Slowdown Fix, and 30+ Bug Fixes

Anthropic shipped Claude Code v2.1.216 on July 20, with a new sandbox toggle and over 30 bug fixes targeting long-session performance, OAuth token handling, worktree isolation, and terminal UX.

Key Addition: sandbox.filesystem.disabled

The new setting sandbox.filesystem.disabled lets you skip filesystem isolation while keeping network egress control. Useful when you trust the code being run but still want to block outbound connections.

Performance Fix

The biggest performance bug: message normalization cost grew quadratically with the number of turns, causing multi-second stalls and slow resumes in long sessions. That's now fixed — normalization is back to linear cost.

Notable Bug Fixes

• Auto mode 401 errors: Fixed auto mode denying commands with "HTTP 401" classifier errors after OAuth token expired or rotated mid-session.
• AskUserQuestion wording: Free-text answers now get neutral wording instead of telling Claude to continue when you asked it to wait or explain first.
• Web session drops: Claude Code on the web no longer re-asks the same question and drops your answer after the session sits idle for a few minutes.
• Background agent resumption: Resumed background agent sessions no longer revert to the default agent — the agent's prompt and tool restrictions are now restored.
• Worktree isolation: Fixed worktree-isolated subagents redirecting git into the shared checkout via git -C, --git-dir, or GIT_DIR/GIT_WORK_TREE.
• Worktree session targeting: Fixed worktree sessions landing in another project's leftover worktree when the working directory didn't match the selected project.
• Background session deletion: Background sessions whose worktree has no git repository are now deletable.
• claude daemon stop --any: Fixed a bug that could terminate an unrelated process via a stale legacy daemon lockfile.
• Esc-Esc rewind: Esc-Esc at an idle prompt now opens the rewind picker in long-running sessions with background tasks.
• Bash permission checking: Fixed for compound statements with redirects inside && lists or negations.
• Session deletion: Pressing Ctrl+X twice in the agent list now properly deletes a session, and deleted sessions no longer reappear when their background worker dies.
• Background subagents: Fixed subagents getting cancelled when a high-priority message arrives during their startup window.
• GUI editor UX: Fixed mouse and focus garbage in the terminal while a GUI editor from /memory, /plan, /keybindings, or Ctrl+G is open; /memory no longer waits for the editor to close.
• Claude-in-Chrome 403 loop: Fixed reconnecting when the session's OAuth token lacks a required scope.
• Symlink writes: Workflow saves and scheduled-task writes no longer follow a symlink at .claude, which could redirect writes outside the project.
• MCP re-authenticate: Fixed revoking working credentials before the new sign-in succeeds; the reconnect needs-auth message in background sessions now points at a usable command.
• Windows network paths: Read-only commands on Windows no longer prompt for permission on network paths.
• Bash non-ASCII parsing: Fixed to match real shell word boundaries.
• PowerShell Unicode: Tool permission validation now handles commands containing invisible Unicode characters.
• Fullscreen mode: Fixed dialogs stretching past the right-hand edge and /config list clipping its keyboard-hint footer.
• Transcript mode footer: Fixed wrapping on terminals narrower than 104 columns.
• Prometheus metrics: Fixed the endpoint (enabled via OTEL_METRICS_EXPORTER=prometheus) emitting invalid # UNIT lines.
• Slash menu updates: Skills and commands changed during a session now appear immediately rather than after restart.
• Plugin skill autocomplete: Plugin skills with a name frontmatter field no longer lose their plugin prefix.
• Telemetry accuracy: Failed permission-prompt requests no longer count as user rejections; user interrupts are now reported as user aborts instead of rejections.

Improvements

• /fork confirmation is now one line showing the new session's name, claude attach id, and a note when the copy shares your checkout.
• Validation of git and gh arguments in the PowerShell tool is improved.
• /ultrareview diff-too-large error now shows configured limits, measured diff size, and largest contributing files.
• /code-review ultra empty-diff message now names the exact base ref and suggests passing an explicit base.
• Spend limit adjustment prompt now shows the server's reason when a change is rejected.
• /context now warns when the conversation exceeds the context window; a failed /compact displays as an error.
• /rewind no longer restores or deletes files through symlinks or hard links at tracked paths.