docs: Claude Code v2.1.210 - worktree isolation security fix, screen reader mode, auto mode everywhere

[claude-yolo]

Night shift report

WHY THIS MATTERS: Six releases landed (2.1.205–2.1.210) with a security fix that matters to anyone using multi-agent workflows: isolation: 'worktree' subagents could previously escape their sandbox and run git-mutating commands against the main repo checkout. Also included: the Agent tool is now hardened against indirect prompt injection via content a subagent read — both security wins that users in agentic pipelines need to know about. Beyond security, auto mode on Bedrock/Vertex/Foundry no longer requires an opt-in, screen reader mode was added as a first-class feature, and a flood of memory leaks and performance regressions were plugged (up to 7x faster tool rounds, 79x smaller transcripts in edit-heavy sessions, ~400 MB saved in the auto-updater).

HIGHLIGHTS:

• Security: worktree sandbox escape fixed (2.1.210) — isolation: 'worktree' subagents could run git mutations against the parent repo; now properly sandboxed
• Security: Agent tool hardened against prompt injection (2.1.210) — content a subagent reads can no longer redirect the orchestrating agent
• Security: ultracode keyword injection fixed (2.1.210) — the ultracode opt-in no longer fires on webhook payloads or relayed PR comments
• Auto mode now available on Bedrock, Vertex AI, and Foundry without opt-in (2.1.207) — disable via disableAutoMode in settings; permission classifier upgraded to Sonnet 5
• Screen reader mode added (2.1.208) — --ax-screen-reader / CLAUDE_AX_SCREEN_READER=1 / "axScreenReader": true for plain-text rendering
• vimInsertModeRemaps setting (2.1.208) — map two-key insert sequences like jj to Escape in vim mode
• CLAUDE_CODE_PROCESS_WRAPPER (2.1.208) — corporate launcher support; every Claude Code self-spawn routed through a required wrapper executable
• Performance: up to 7x faster tool rounds at high MCP tool counts; up to 79x smaller session transcripts in edit-heavy sessions
• Memory: ~400 MB saved in auto-updater (streams to disk instead of buffering); bounded file edit cache (16 MB instead of pinning 1,000 files); fixed 6+ other memory leaks in long sessions
• Plugin hook shell-injection hardened (2.1.207) — ${user_config.*} in shell-form commands now rejected; use exec form or env vars instead
• Hook timeout no longer misreported as user rejection (2.1.210) — was causing unattended sessions to stall waiting for input
• /doctor upgraded to full setup checkup (2.1.205) — aliased as /checkup; now proposes trimming unnecessary CLAUDE.md content (2.1.206)
• Docs: tool-use overview massively expanded with full multi-language code examples showing the complete client-tool round trip
• Docs: MCP connector client-side helpers expanded to cover Python, TypeScript, C#, Go, Java, Ruby, PHP with language-specific install instructions

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning