Claude Code v2.1.216: Agent Permissions No Longer Drift When Sessions Resume

TL;DR: v2.1.216 (released July 20 after the evening run) closes three permission-drift bugs that let restricted agents silently regain broader access on resume or across worktrees.

Released at 6:14 PM ET on July 20, v2.1.216 focuses on permission continuity — the category of bugs where Claude Code quietly loses its security context:

• Resumed agents recover their original restrictions. Previously, resuming a background agent reset it to the default agent's tool set and permissions — a restricted agent (no web access, limited tool list) could silently regain full access. Fixed: resume now restores the exact prompt and tool restrictions from the original session.

• "Always allow" rules save at the repo root. Approving a rule in one git worktree now persists it across all worktrees for that repository. Before, each worktree started with a clean allowlist, creating friction in parallel-agent workflows.

• Worktree subagent git redirect blocked. A worktree-isolated subagent could escape its sandbox by passing git -C, --git-dir, or GIT_DIR/GIT_WORK_TREE flags, redirecting operations into the shared checkout. Fixed at the flag-parsing level.

• sandbox.filesystem.disabled setting added. Allows keeping network-egress sandboxing while disabling filesystem isolation — useful for Docker-based CI where container isolation already handles the filesystem layer.

• Stale git worktree locks cleaned up. The periodic sweep now releases locks whose owning process is gone, preventing unkillable background sessions.

Why it matters: Permission drift is the silent enemy of multi-agent workflows. Approving a tool for one restricted task shouldn't cascade into resumed sessions or sibling worktrees — now it doesn't.

Sources: v2.1.216 Release Notes — GitHub · Claude Code changelog — code.claude.com