Claude Code 2.1.216 Tests Whether Agent Permissions Survive the Handoff

A restricted coding agent was sent into the background. Its conversation survived the trip. Its restrictions allegedly did not.

That is the sequence described in a Claude Code issue filed on July 18. The reporter said a custom subagent resumed with its prior context but as the default agent, exposing a broader tool set than the role had been given. The report concerns version 2.1.214 and remains open. Anthropic does not link it to a particular patch. Yet the Claude Code 2.1.216 release notes now say resumed background-agent sessions restore the original prompt and tool restrictions rather than falling back to the default agent.

That is more revealing than an ordinary permission denial. Remembered context paired with forgotten authority can make an agent look continuous while its mandate has changed underneath it.

The useful way to read version 2.1.216 is therefore not as a grab bag of fixes. It is a test of authority continuity: whether an agent’s identity, capabilities, workspace and recovery scope remain bound together when a session moves from foreground to background, into a worktree, through a restart or back to an earlier checkpoint.

What shipped, and what the public evidence can prove

The first official 2.1.216 platform package appeared in Anthropic’s npm registry at 4:17:23 p.m. ET on July 20, followed by the wrapper package about two minutes later. The GitHub release page arrived at 6:14 p.m. ET. TECHi uses the earlier package timestamp as the start of the event, rather than treating the later release page as a new clock.

The release groups several changes around agent lifecycle boundaries. Anthropic says it fixed resumed-agent identity, Git worktree containment, symlink handling in saves and rewind, permission parsing, long-session stalls and stale process targeting. It also added a setting that can disable filesystem isolation while retaining network egress controls.

There is an important transparency ceiling. The public comparison for 2.1.216 changes the changelog and release feed; it does not expose the product implementation or linked pull requests. No advisory or CVE was attached to the release. The claims below are therefore attributable to Anthropic’s notes and documented behavior, not an independent audit of the binary.

Four invariants make an agent the same agent

A safe agent session has at least four pieces of authority that must travel together.

Identity is the system prompt and role that define what the agent is supposed to do. Capability is the tool set and permission policy that define what it may do. Workspace is the effective repository, branch, files and environment its commands can reach. Recovery scope is the set of files, processes and saved state that rewind, cleanup or restart logic can modify.

Static permission screens show only one frame. The harder question is whether those four invariants survive a transition. Backgrounding, resuming, forking, restoring and switching worktrees are exactly where metadata can separate from the conversation it governs.

Anthropic’s subagent documentation says custom agents have their own prompt, tools and permissions. It also says a selected agent persists when a session resumes. If conversation history comes back but the role and tools do not, the interface preserves familiarity while dropping the contract. That mismatch is dangerous because it is easy for both the user and the model to assume continuity.

This is also why the change reaches beyond one bug report. Production coding agents are increasingly delegated narrow jobs: review a diff without editing it, inspect logs without deploying, or research a dependency without reaching credentials. A resumed read-only reviewer that silently becomes a general agent is not merely mislabelled. It has acquired a different action surface.

Worktree isolation depends on Git’s effective destination

Worktrees are useful because concurrent agents can receive separate directories and branches without cloning an entire repository. But Anthropic’s worktree guide is clear about the boundary: worktrees isolate working files and branches while sharing repository history and remotes. They are not operating-system sandboxes.

Version 2.1.216 says worktree-isolated subagents can no longer redirect Git into the shared checkout through four routes: the git -C option, –git-dir, the GITDIR environment variable and GITWORK_TREE. That list matters. Checking only a process’s current directory is insufficient when Git accepts its own control-plane inputs that can resolve another repository context.

The TECHi angle is straightforward: containment has to validate the effective destination after command arguments and environment variables are resolved. A command can begin inside an isolated directory and still target the parent checkout if the tool honors a different repository path.

Anthropic also says the release fixes sessions that landed in another project’s leftover worktree when the current directory did not match the selected project. A separate cleanup fix addresses background sessions whose worktree no longer contains a repository and could not be deleted.

Open user reports show the kind of damage teams worry about, but they should not be treated as confirmed matches. One July report described an empty worktree directory resolving to a parent repository; another described branch changes across parallel Windows sessions. Both remained open during TECHi’s review, and neither publicly proves the exact redirection mechanism named in the 2.1.216 notes.

The operational risk is larger than a stray file. In a multi-agent run, a repository-context mistake can move a commit, flip a shared branch or contaminate work another session considers independent. Our recent analysis of Cline’s agent-role controls reached the same underlying point from a different product: hiding or granting a tool is useful, but role boundaries, filesystem reach and failure reporting remain separate controls.

Rewind code deserves stricter path rules than ordinary edits

Recovery features are privileged because they can restore and delete, not merely append. Anthropic says the 2.1.216 rewind path now skips symlinks and hard links instead of restoring or deleting through them, and reports how many paths it skipped. Workflow and scheduled-task saves are also said to stop following a .claude symlink outside the project.

The checkpointing documentation narrows what rewind promises. It tracks direct edits made through Claude’s file tools, not changes made by Bash commands or outside processes, and it is not a replacement for Git. That caveat is good architecture: a convenient local restore should not be mistaken for a durable repository history.

Symlinks make recovery especially sensitive. A path displayed inside a project can resolve elsewhere on disk. Hard links can give two names to the same underlying file. Restore logic that trusts the visible path rather than the resolved object can cross the boundary it is supposed to repair.

This is the recovery-scope invariant in practice. Before a tool rewinds a session, it must know not only which snapshot is selected but which real filesystem objects the operation will touch.

The new sandbox switch is a deliberate trade

The release notes add sandbox.filesystem.disabled, which Anthropic says allows filesystem isolation to be turned off while network egress controls remain enabled. That can help in environments where filesystem sandboxing breaks a required workflow but a network allowlist is still valuable.

It should not be read as equivalent protection. Anthropic’s sandboxing documentation warns that effective isolation relies on both filesystem and network controls. If an agent can modify host resources that a later trusted process will execute, it may regain network access indirectly. The network filter is hostname-based and does not inspect TLS traffic. Built-in Read, Edit and Write tools are governed by the permission system rather than the Bash sandbox.

The new key had not yet appeared in the configuration documentation TECHi reviewed, so teams should not infer a broader recipe from the one-line release note. Leave filesystem isolation enabled by default. If compatibility requires turning it off, document the specific blocker and the compensating controls.

That distinction echoes our CrewAI control-hooks review: observability and interception improve governance, but they do not collapse identity, approval, filesystem and network policy into one control.

Smaller fixes point to the same boundary

Several less prominent changes reinforce the same theme.

Anthropic says compound Bash statements with redirects inside conjunctions or negations are parsed more accurately for permission checks. It also cites non-ASCII word-boundary handling, invisible Unicode validation in PowerShell, tighter git and GitHub CLI argument validation, and a Windows rule that blocks nominally read-only commands from reaching network paths without permission.

An auto-mode fix separates authentication failure from authorization policy: an expired or rotated OAuth credential could reportedly cause the command classifier to return HTTP 401, after which commands were denied. Another fix distinguishes permission failures from user interrupts in telemetry. Better classification does not enforce security by itself, but it helps operators diagnose whether a run was blocked by policy, identity expiry or an explicit human stop.

Process identity gets attention too. The release says claude daemon stop –any could target an unrelated process through a stale legacy lockfile. A command intended to clean up one agent should not inherit authority over whichever process later occupies the recorded identifier.

Performance belongs in the same operational picture. Anthropic says message normalization could become quadratic in long sessions, producing multi-second stalls and slow resumes. A delayed transition can encourage retries or duplicate interventions, so reliability defects can complicate an otherwise sound control model.

The release sequence shows where agent risk is moving

Claude Code 2.1.212 expanded background and worktree workflows. Version 2.1.214 tightened multiple permission and daemon boundaries. Version 2.1.215 stopped Claude from invoking verification and code-review skills autonomously, returning that initiation to the user. Version 2.1.216 concentrates on what happens between states.

As agent systems become more concurrent, transitions become an accident surface of their own. A launch-time policy can be correct and still fail if a resume reconstructs the wrong role, a Git option redirects the effective workspace, or recovery follows a link beyond the project.

That is why production agent controls need evidence at runtime, not only a configuration screenshot. The relevant audit record is not simply which permissions were set. It is which identity, capabilities, repository and recovery boundary were active for each action.

What teams should test after upgrading

Start by confirming the installed version through the official Claude Code update path. The npm registry is useful for timestamp provenance, but Anthropic’s current repository guidance deprecates npm installation in favor of its supported installer.

Then run harmless regression tests in a disposable repository. Create a custom agent without a benign tool, send it to the background, resume it and confirm both its identity and the denial survive. In a disposable worktree, record the output of Git’s top-level directory, Git directory, current branch and worktree list before and after the isolated session. Do not aim these tests at a production branch.

Exercise rewind on files that include safe test symlinks and inspect the skipped-path report. Keep Git as the durable recovery layer. If the team uses scheduled tasks, confirm their saved definitions remain inside the intended project directory.

Finally, track the open issues and release notes. Anthropic’s notes make 2.1.216 an important upgrade, but a version string is not an independent remediation test. The Replit agent productivity evidence showed why measured outcomes matter more than architecture alone; the same discipline applies to permission continuity.

Claude Code 2.1.216 matters because it treats identity, tool grants, repository context and recovery paths as parts of one lifecycle. Its strongest lesson is broader than Claude Code: agent governance is not the permission list at launch. It is whether that authority survives every handoff.