Matins
← All briefs
Matins
Saturday 11 July — v2.1.207
22 changes / 4 actionable / 2 deep dives
Claude Code
  • Auto mode is now on by default on Bedrock, Vertex AI, and Foundry. The CLAUDE_CODE_ENABLE_AUTO_MODE opt-in is gone; disable via disableAutoMode in settings if you were relying on it being off (more below).
  • Plugin ${user_config.*} in shell-form commands is now rejected as a shell-injection fix. Hooks, monitors, and headersHelper scripts using this pattern need to switch to exec form (args array) or read $CLAUDE_PLUGIN_OPTION_<KEY> inside the script.
  • autoMode no longer reads from .claude/settings.local.json. If you configured auto mode per-repo there, move it to ~/.claude/settings.json.
  • Plugin option values (pluginConfigs) are no longer read from project-level .claude/settings.json. Only user, --settings, and managed settings are honored now, so move any project-level plugin config up.

New in 2.1.207

2.1.207 (July 11, 2026)

  • Auto mode is now available without CLAUDE_CODE_ENABLE_AUTO_MODE opt-in on Bedrock, Vertex AI, and Foundry; disable via disableAutoMode in settings
  • Fixed the terminal freezing and keystrokes lagging while streaming responses containing very long lists, tables, paragraphs, or code blocks
  • Fixed remote managed settings from a non-interactive run (claude -p, the SDK) being permanently recorded as consented without ever showing the security consent dialog
  • Fixed spurious prompt-injection warnings triggered by benign system-generated conversation updates
  • Fixed the auto-updater overwriting a custom launcher script or symlink at ~/.local/bin/claude on every release; /doctor now reports an externally managed launcher
  • Fixed compound commands with cd prompting for permission when the only output redirect was to /dev/null
  • Fixed the transcript jumping above the start of the answer when a response finishes streaming
  • Fixed extensions.worktreeConfig being left in the repo's .git/config (breaking go-git tools like tea) after the last worktree.sparsePaths worktree was removed
  • Fixed malformed bracket patterns in rules globs, skill paths, .ignore, and .worktreeinclude breaking file reads, file suggestions, and worktree creation
  • Fixed a crash loop in agent teams where a malformed teammate mailbox message caused repeated errors every second until the mailbox file was manually deleted
  • Fixed background sessions auto-named by accepting a plan not showing that name on their agent-view row
  • Fixed background sessions that entered a git worktree resuming blank after a cold reopen from the agent list
  • Fixed Remote Control task status updates being lost when the connection recovered from a network interruption or credential refresh
  • Fixed Remote Control sessions hosted by the desktop app not showing background agent and workflow progress on mobile and web
  • Fixed Deep research runs labeling every Fetch-phase agent "unknown"; chips now show the source hostname
  • Fixed Bedrock repeatedly requesting fresh AWS SSO credentials from IAM Identity Center on every API request
  • Improved agent view: pasting the same text again now expands the collapsed [Pasted text #N] placeholder instead of adding a second one
  • Improved agent view: blocked session peeks now lead with the question and show a worded staleness clock (waiting 3m) instead of the same timestamp twice
  • Changed Bedrock, Vertex, and Claude Platform on AWS to default to Claude Opus 4.8
  • Changed auto mode to no longer read autoMode from .claude/settings.local.json (repo-resident); use ~/.claude/settings.json instead
  • Fixed an indefinite hang on Windows when AWS credential resolution stalls (e.g. a stuck credential_process): the 60-second stall guard now fires instead of waiting forever
  • Plugin hooks/monitors/MCP headersHelper: ${user_config.*} in shell-form commands is now rejected (shell-injection fix). Hooks: use exec form (args array) or $CLAUDE_PLUGIN_OPTION_<KEY>; monitors and headersHelper: read the value inside the script (config file or the server's env block).
  • Plugin option values (pluginConfigs) are no longer read from project-level .claude/settings.json; only user, --settings, and managed settings are honored
  • Fixed /usage-credits amount inputs silently stripping malformed values (e.g. a pasted timestamp) to digits; malformed amounts are now rejected with an error, and amounts over $1,000 require a typed confirmation

Notes

Auto mode's cloud rollout is complete. 2.1.193 added autoMode.classifyAllShell to route all shell commands through the classifier. 2.1.205 added rules blocking transcript tampering and dangerous rm -rf invocations. With 2.1.207, auto mode no longer requires explicit opt-in on Bedrock, Vertex AI, or Foundry. If you run on any of these providers and had not set CLAUDE_CODE_ENABLE_AUTO_MODE, auto mode is now active. The disableAutoMode setting is your off switch; the autoMode setting itself has also moved out of .claude/settings.local.json and into ~/.claude/settings.json, so per-repo overrides via the local file no longer work.

Plugin config surface area is shrinking for security. The ${user_config.*} interpolation in shell-form commands was a shell-injection vector (2.1.163 patched the crash when optional fields were blank, but the underlying injection risk remained). It is now rejected outright in hooks, monitors, and headersHelper scripts. Separately, pluginConfigs values are no longer read from project-level .claude/settings.json, closing a path where a committed settings file could inject values into a plugin's options. Both changes tighten the boundary between repo-controlled and user-controlled configuration.