release aidev BREAKING SIG 3/5

Claude Code 2.1.218: background code review, untrusted-hook fix, agent name restriction

A large maintenance release that moves /code-review into a background subagent, tightens trust rules around agent frontmatter hooks, and changes several defaults. Anyone with agent files whose names contain a colon, or skills using context: fork, will see behavior change without any action on their part.

PUBLISHED2026-07-22
OBSERVED2026-08-11
AGE20d
SOURCES1
  • /code-review now runs as a background subagent so review output no longer fills the conversation; stacked slash commands stay as its review target
  • Agent markdown files now reject agent names containing : (reserved for plugin namespacing)
  • Skills with context: fork now run in the background by default; opt out per skill with background: false
  • Agent frontmatter hooks no longer run from untrusted folders — the agent file's own folder must have accepted workspace trust
  • /deep-research only starts when invoked manually; Claude no longer launches it on its own
  • Auto mode: dangerous-rm, background-&, and suspicious-Windows-path checks are adjudicated by the auto-mode classifier instead of opening permission dialogs; plan mode no longer prompts for Bash commands the static analyzer can't prove read-only
  • Skill and plugin frontmatter booleans accept yes/no/on/off/1/0 (case-insensitive)
  • Fixed Windows paths with \u-prefixed segments (e.g. C:\Users\unicorn) being corrupted into CJK characters, making those files inaccessible
  • Fixed the left arrow key discarding a conversation with no undo; presses right after editing now confirm first
  • Fixed /ultrareview failing on descriptive arguments, and /code-review ultra silently running a local review in non-interactive sessions
  • Fixed gateway spend metering to price Bedrock application-inference-profile ARNs at the configured model's rates
  • Fixed remote sessions heartbeating forever after their worker was replaced
  • Several accessibility fixes in --ax-screen-reader mode (deletion announcements, cursor tracking in panels, VoiceOver space echo)
fixfeaturebreakingsecurity

COMMUNITY

No curated reactions recorded for this event. Facts and takes are kept in separate layers — community context is added by hand, never blended into the record above.