release aidev SIG 3/5

Claude Code 2.1.216: sandbox filesystem toggle, quadratic long-session slowdown fixed

Adds sandbox.filesystem.disabled to skip filesystem isolation while keeping network egress control, and fixes message normalization cost growing quadratically with turn count, which caused multi-second stalls and slow resumes. Several worktree and symlink isolation holes are closed.

PUBLISHED2026-07-20
OBSERVED2026-08-11
AGE22d
SOURCES1
  • New sandbox.filesystem.disabled setting: skip filesystem isolation, keep network egress control
  • Fixed quadratic message-normalization cost in long sessions (multi-second stalls, slow resumes)
  • Fixed worktree-isolated subagents redirecting git into the shared checkout via git -C, --git-dir, GIT_DIR/GIT_WORK_TREE
  • Fixed workflow saves and scheduled-task writes following a .claude symlink, which could write outside the project
  • Fixed read-only commands on Windows reaching network paths without a permission prompt
  • /rewind no longer restores or deletes through symlinks/hard links at tracked paths and reports skipped paths
  • Fixed Bash permission checking for compound statements with redirects inside && lists or negations, non-ASCII word boundaries, and invisible Unicode in PowerShell commands
  • Fixed auto mode denying commands with "HTTP 401" classifier errors after mid-session OAuth token rotation
  • Fixed resumed background agent sessions reverting to the default agent, losing the agent's prompt and tool restrictions
  • Fixed worktree sessions landing in another project's leftover worktree; undeletable sessions whose worktree has no git repo
  • Fixed claude daemon stop --any potentially killing an unrelated process via a stale legacy lockfile
  • Fixed MCP re-authenticate revoking working credentials before the new sign-in succeeded
  • Fixed skills and commands changed mid-session not appearing in the slash menu until restart
  • /context warns explicitly when the conversation exceeds the context window; a failed /compact shows as an error
  • Telemetry: failed permission prompts no longer counted as user rejections; interrupts reported as aborts
  • Fixed cloud sessions dropping an in-flight message when the container restarts mid-turn
featurefixsecurity

COMMUNITY

No curated reactions recorded for this event. Facts and takes are kept in separate layers — community context is added by hand, never blended into the record above.