Claude Code 2.1.210 Through 2.1.216: /fork, Security Hardening, and a Performance Regression Fixed

Anthropic shipped seven Claude Code releases between July 14 and July 20, versions 2.1.210 through 2.1.216. The last roundup on this site covered 2.1.208 and 2.1.209. Here’s what changed.

The headline feature: /fork

Version 2.1.212, released July 17, added /fork. It copies your current conversation into a new background session while you keep working in the original. The previous behavior, where /fork launched an in-session subagent, is now /subtask. If you use /fork in your workflows, you’ll need to update.

The same release added /resume in the agent view, which opens a picker of past sessions that can be brought back as background sessions. It also capped WebSearch calls at 200 per session (configurable with CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION) and MCP tool calls that run longer than two minutes now automatically move to background, configurable via CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS.

The most important fix: the slowdown in long sessions

Version 2.1.214 (July 18) introduced a fix that looks routine in the changelog but matters for anyone doing extended agentic work. Message normalization cost was growing quadratically with the number of turns in a session, causing multi-second stalls after extended use. That fix carries forward into 2.1.216.

Security hardening in 2.1.214

The same release contained the most concentrated set of permission fixes in recent memory:

A dir/** allow rule was approving writes to matching directories anywhere in the filesystem, not just under <cwd>/dir
Windows PowerShell 5.1 sessions had a permission-check bypass
File-descriptor redirect forms in Bash were failing closed on checks (meaning commands could pass that shouldn’t)
Commands longer than 10,000 characters were not being flagged for prompting
Certain help and man commands were being auto-approved in cases where they shouldn’t have been
docker commands with daemon-redirect flags now get permission prompts

Claude Code also added an EndConversation tool in 2.1.214, which handles sessions with highly abusive users or jailbreak attempts, and added periodic progress heartbeats for long-running tool calls so a session doesn’t appear frozen.

A behavioral change in 2.1.215

Starting with 2.1.215 (July 19), Claude no longer auto-runs the /verify or /code-review skills. You have to call them with /verify or /code-review explicitly. The previous behavior, where Claude would run these on its own judgment, is gone.

What 2.1.216 added

The July 20 release added a sandbox.filesystem.disabled setting. This lets you turn off filesystem isolation while keeping network egress controls, which is useful for workflows where you want egress enforcement but don’t want the performance overhead or path restrictions of full filesystem sandboxing.

2.1.216 also fixed a bug where resumed background agent sessions would revert to the default agent, losing the original prompt and tool restrictions. And it fixed a git issue where worktree-isolated subagents could run mutating commands against the main repo via git -C, --git-dir, or environment variables.

Earlier in the batch

2.1.210 (July 14) added a live elapsed-time counter to the collapsed tool summary line so you can see a running timer rather than a frozen UI during slow tool calls. It also reduced per-tool-call CPU overhead by caching tool-pool assembly, which the release notes say is 7x faster at high tool counts.

2.1.211 (July 15) added --forward-subagent-text and the CLAUDE_CODE_FORWARD_SUBAGENT_TEXT environment variable for getting subagent text and thinking output in stream-json mode.

Sources: Claude Code changelog — GitHub releases