claudekit / updates / claude-code-2-1-205
[ PATCH · ]

Claude Code 2.1.205

Auto mode gains a rule that blocks tampering with session transcript files and now asks before running `rm -rf` on a variable it can't resolve from context. Background agents and the agent view report session state more accurately, and `/doctor` becomes a full setup checkup that can diagnose and fix issues (`/checkup` alias). Auto-update binary downloads stream to disk instead of buffering in memory, cutting peak memory by roughly 400 MB, alongside fixes for Windows worktree removal deleting files outside the worktree, a message lost at the `--max-turns` limit, and `--json-schema` silently producing unstructured output on an invalid schema.

Claude Code
Official announcement →

This article is a summary based on official documentation.

What changed

Claude Code 2.1.205 shipped on July 8, 2026. Auto mode adds safety rules — blocking tampering with session transcript files and asking before a risky rm -rf — while background agents and the agent view now reflect real session state more accurately. /doctor grows into a full checkup that can diagnose and fix issues, and the release lands memory savings in the auto-updater plus fixes across Windows crashes and session-to-PR linking.

New features

  • /doctor is now a full setup checkup (/checkup alias)

    /doctor previously only reported on configuration state, so when it surfaced a problem you had to fix it yourself. /doctor is now a full setup checkup that can diagnose and fix issues, and it can also be run as /checkup.

Key improvements

  • Auto mode asks before running rm -rf on an unresolvable variable

    When auto mode ran rm -rf on a variable whose value it couldn’t determine, it risked deleting an unexpected location instead of the intended path. Auto mode now asks before running rm -rf on a variable it can’t resolve from context.

  • Auto mode blocks tampering with session transcript files

    Session transcripts are the record of what actually happened in a conversation, but nothing prevented them from being edited out from under you. Auto mode now includes a rule that blocks tampering with session transcript files.

  • Auto-update downloads stream to disk (~400 MB lower peak memory)

    The auto-updater buffered the entire new binary in memory before writing it to disk, spiking memory usage during an update. Auto-update binary downloads now stream to disk instead of buffering in memory, cutting the updater’s peak memory usage by roughly 400 MB.

  • Background task notifications state that no human input occurred

    A background task notification alone didn’t make clear whether a human had approved anything, leaving room for a fabricated in-transcript approval to be treated as real. Notifications now explicitly state that no human input has occurred, preventing fabricated in-transcript approvals from being acted on.

  • Agent view links more existing-PR sessions

    Session-to-PR linking in claude agents only caught certain cases. Sessions that edit, merge, comment on, or push to an existing PR now link it in claude agents.

  • Agent view shows a state word and a headline instead of raw tool calls

    Each agent view row showed raw tool call text, making status hard to read at a glance. Rows now show a colored state word and a classifier-written headline instead of raw tool call text, and the peek opens with full status including the exact ask for blocked sessions.

Bug fixes

Sessions and output

  • --json-schema silently produced unstructured output when the schema was invalid — this, along with schemas using the format keyword being rejected, is now fixed.
  • A message sent while Claude was working was silently lost when the turn ended at the --max-turns limit — fixed.
  • Session-to-PR linking missed a PR created in a Bash call whose output exceeded the 30K inline limit — fixed.

Background agents

  • Background agents stayed shown as “failed” or “completed” in the agent list after being resumed with SendMessage — fixed.
  • Background jobs flipped from “needs input” back to “working” in the agent list when the agent’s turn contained no readable text — fixed.
  • claude attach erroring when a background agent was mid-upgrade restart instead of waiting for it to come back — fixed.
  • Background tasks in the web and mobile Remote Control panels showed a stale “Running” status — fixed by forwarding full task state on every membership change.

MCP and plugins

  • claude mcp add-from-claude-desktop got stuck when a server name contained unsupported characters — invalid names are now reported and the remaining servers still import.
  • A plugin LSP server that fails to initialize prevented a valid LSP server from another plugin from handling the same file extension — fixed.

Terminal and platform

  • Windows worktree removal deleted files outside the worktree when an NTFS junction or directory symlink existed inside it — fixed.
  • A Windows crash when the directory Claude was launched from is deleted, locked, or unmounted while a command was running — fixed.
  • A crash when a file watcher was closed while a directory scan was still in flight — fixed.
  • The agent view rendered one line too high and clipped its header when the job list slightly overflowed the screen — fixed.
  • Project verify skills were rewritten on every session instead of only when a documented command changed — fixed.

Cowork

  • Cowork VM-mode local-agent sessions failed to start with “Not logged in · Please run /login” on CLI 2.1.203+ — fixed.

Notes

  • /doctor and /checkup are the same tool — the expanded full setup checkup runs under either name.
  • “Claude Browser” MCP server name reserved — ahead of the Claude Desktop pane rename, “Claude Browser” is now reserved alongside “Claude Preview”; user-configured MCP servers can no longer register under either name.
  • rm -rf confirmation in auto mode — auto mode now asks before running rm -rf on a variable it can’t resolve from context, guarding against a broad deletion caused by an empty or unexpected variable value.