Claude Code v2.1.215 to v2.1.216 Major Updates - Addition of sandbox settings and faster long sessions

This is Ishikawa from the Cloud Business Division. Here is a summary of the Claude Code updates from v2.1.215 to v2.1.216 (2026-07-19 to 2026-07-20). While new features are modest this time, the updates mainly consist of fixes that improve day-to-day stability and security. I also tried out the new sandbox.filesystem.disabled feature.

The previous update article is here.

https://dev.classmethod.jp/articles/20260718-cc-updates-v2-1-214/

Update Summary

This covers 2 versions (v2.1.215 to v2.1.216, 2026-07-19 to 2026-07-20) with a total of 41 changes. New features are limited to just one addition — sandbox.filesystem.disabled — while the majority of the remaining changes consist of bug fixes including security and permissions hardening, along with improvements to existing features.

Notable Updates

Stopping Auto-execution of /verify and /code-review (v2.1.215)

The /verify and /code-review skills, which Claude previously ran automatically based on context, will no longer run automatically. When you want to run them, you explicitly call /verify or /code-review.

For those who want control over when reviews and verifications run, this should feel more manageable.

Addition of sandbox.filesystem.disabled (v2.1.216)

The sandbox.filesystem.disabled setting has been added. It allows you to skip only the filesystem isolation while maintaining network egress controls.

This is suited for environments like CI or containers where the filesystem is already isolated and you want to avoid double isolation. It should be effective for those using sandboxes in such environments.

Resolving Stalls in Long Sessions (v2.1.216)

A problem has been fixed where message normalization costs grew quadratically with the number of turns in long sessions, causing multi-second stalls and slow resumption.

The sluggishness in long sessions that got worse as turns accumulated is now resolved. The improvement should be most noticeable for those who keep running large tasks within a single session.

Target Versions and Period

New Features

• Addition of the sandbox.filesystem.disabled setting (v2.1.216). See "Notable Updates" and "Tried It Out" for details.

Improvements

• Improved status display for /context and /compact: When a conversation exceeds the context window, /context now shows an explicit warning, and a failed /compact is displayed as an error (v2.1.216).
• Improved confirmation display for /fork: The confirmation is now a single line showing the new session name, the claude attach ID, and a note if the copy shares a checkout (v2.1.216).
• Improved error messages for /ultrareview: When a diff is too large, it now shows the configured limit, the actual diff size, and the files with the largest contributions (v2.1.216).
• Improved error messages for /code-review ultra: When a diff is empty, it now shows the exact base ref name and suggests specifying an explicit base (v2.1.216).
• Other changes include displaying reasons when spend limit changes are rejected, suspending input waiting for /mcp and /install-github-app in background sessions, and updates to the bundled dataviz skill (chart palette reordering and guidance corrections) (all v2.1.216).

Security and Permissions Fixes

This release includes many fixes related to permission checks and path resolution.

• Fixed permission checks for Bash compound commands: Compound commands with redirects inside && lists and negations are now correctly inspected (v2.1.216).
• Fixed write redirection via .claude symlinks: Fixed an issue where workflow saves and scheduled task writes could follow symbolic links and stray outside the project (v2.1.216).
• Fixed unauthorized access to Windows network paths: Fixed an issue where read-only commands could access network paths without a permission prompt (v2.1.216).
• Fixed PowerShell permission validation: Fixed permission validation for commands containing invisible Unicode characters (v2.1.216).
• Improved validation of git and gh arguments in PowerShell (v2.1.216).
• Prevented link-based manipulation in /rewind: Files are no longer restored or deleted by following symbolic links or hard links in tracked paths, and the number of skipped paths is reported (v2.1.216).

Fixes (Major ones)

A selection of fixes related to stability and usability.

• Fixed message loss in cloud sessions: Even if a container restarts mid-turn, the interrupted turn is now re-executed on resumption, and sessions no longer get stuck in an unresponsive state (v2.1.216).
• Fixed agent disappearance when resuming background agents: Resumed sessions no longer revert to the default agent, and the agent's prompts and tool restrictions are now restored (v2.1.216).
• Fixed landing in a worktree from a different project: Fixed an issue where, if the working directory didn't match the selected project, the session would enter a leftover worktree from a different project (v2.1.216).
• Fixed worktree isolation bypass: Fixed an issue where isolated sub-agents could redirect to a shared checkout via git -C, --git-dir, or GIT_DIR/GIT_WORK_TREE (v2.1.216).
• Fixed cancellation of starting background sub-agents: High-priority messages arriving during the startup window no longer fail to cancel the sub-agent (v2.1.216).
• Fixed incorrect rejections in auto mode: After an OAuth token expires or rotates mid-session, commands are no longer rejected with an "HTTP 401" classification error (v2.1.216).
• A quietly welcome fix: Skills and commands changed during a session are now reflected in the slash menu without waiting for a restart (v2.1.216). For those writing and testing skills simultaneously, this is a quietly welcome fix.
• In addition, numerous minor bugs have been fixed related to @mentions, vim operations, re-asking in web sessions, MCP re-authentication, editor display for /memory and similar, UI display in fullscreen and narrow terminals, and bidirectional text display in VSCode.

Trying Out the New Feature sandbox.filesystem.disabled

The newly added sandbox.filesystem.disabled setting is a feature that lets you skip only the filesystem isolation while maintaining network egress controls.

This setting is not a CLI flag but is managed in a settings file. To apply it globally for the user, write it in ~/.claude/settings.json; to share it within a project, use .claude/settings.json; and to try it as a personal project-local setting (outside git management), write it in .claude/settings.local.json. Since confirming the actual isolation behavior requires writing to a settings file and observing execution with sandbox enabled, this article documents the following procedure as the verification steps.

Configuring Sandbox Settings in the Settings File

Add sandbox settings to the settings file. Here is an example of writing to the project-local .claude/settings.local.json (the following is a configuration example).

.claude/settings.local.json:

{
  "sandbox": {
    "enabled": true,
    "filesystem": {
      "disabled": true
    },
    "network": {
      "allowedDomains": [
        "registry.npmjs.org",
        "*.github.com"
      ]
    }
  }
}

sandbox.enabled enables the sandbox, sandbox.filesystem.disabled skips filesystem isolation, and sandbox.network.allowedDomains specifies the domains permitted for egress (npm and GitHub as examples).

Confirming Behavior

With /sandbox set to auto-allow mode, have Claude execute Bash commands and confirm the following 2 points. Since the sandbox affects Bash commands and their child processes, verification is also done via Bash commands.

Confirming that network egress control is active (permitted)

Registered domains pass through without a prompt.

Confirming that network egress control is active (not permitted)

Domains not in allowedDomains are not immediately blocked by default — approval is requested on first access.

To automatically block without prompting, set allowManagedDomainsOnly to true in managed settings.

Confirming that filesystem isolation is skipped

Try "writing outside the working directory," which the normal sandbox would reject.

With filesystem.disabled: true, writing succeeds. Removing the setting (or setting it to false) causes the same operation to be rejected by the sandbox, so this difference confirms that filesystem isolation is being skipped.

In Closing

While the notable new features in this update are limited to the addition of the sandbox setting, this feels like a solid, practitioner-focused release that combines hardening around worktrees, permissions, and symlinks with faster long sessions. It may not be flashy, but the more you use it every day, the more you should feel the improvement in baseline stability.

If any of the changes catch your interest, why not update and check them out?

References

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

https://code.claude.com/docs/en/changelog

https://dev.classmethod.jp/articles/20260718-cc-updates-v2-1-214/