Claude Code v2.1.213-214: Six Permission Bypass Fixes, EndConversation Added, /verify No Longer Auto-Runs

Claude Code v2.1.213-214 (Jul 18-19) closes six permission-check bypasses, changes /verify and /code-review to require explicit invocation, and adds the EndConversation tool for jailbreak defense.

v2.1.214 — Security and stability (Jul 18)

Six permission-check bypasses patched:

1. dir/** allow rules (e.g., Edit(src/**)) auto-approved writes to nested src/ directories anywhere in the tree — not just <cwd>/src/
2. Windows PowerShell 5.1 — permission checks could be bypassed entirely in PS 5.1 sessions
3. File-descriptor redirects (e.g., cmd 3>&1) — bash and the analyzer disagreed on safety; now fails closed
4. Very long commands (>10,000 chars) — now always prompt instead of running automatically
5. Zsh [[ ]] subscripts — variable subscripts/modifiers were treated as inert text, now analyzed correctly
6. help/man with unsafe options — certain forms could trigger command substitutions or backslash paths

Also added: the EndConversation tool (Claude can end sessions with abusive users or jailbreak attempts), docker daemon-redirect flags (--url, --connection, --identity) now require confirmation, and a periodic heartbeat for long-running tool calls that previously went silent.

v2.1.213 — Behavior change (Jul 19)

/verify and /code-review no longer run automatically. They only run when you explicitly invoke /verify or /code-review. If your workflow expected Claude to proactively run these after edits, you'll need to invoke them manually or wire them into a PostToolUse hook.

Why it matters: Fix #1 affects every project with a Edit(src/**) or similar glob allow rule. On any repo with a nested src/ directory, writes may have been approved silently. Update now: npm install -g @anthropic-ai/claude-code@latest

Sources: Claude Code Changelog, GitHub Releases