--- title: "Claude Code v2.1.215–216: /verify and /code-review Stop Auto-Running, and a Worktree Isolation Bug Gets Closed" date: 2026-07-21 tags: ["claude-code","anthropic","release-notes","security","agentic-workflows"] categories: ["AI Tools"] summary: "Claude Code v2.1.215 stops auto-running /verify and /code-review, putting review invocation back under explicit developer control. v2.1.216 follows a day later with a real isolation fix — worktree-isolated subagents could redirect git into the shared checkout via git -C or GIT_DIR — plus a quadratic-slowdown fix and a new sandbox.filesystem.disabled setting." --- ![Claude Code v2.1.215–216: /verify and /code-review Stop Auto-Running, and a Worktree Isolation Bug Gets Closed](/images/claude-code-v2-1-215-216-verify-review-manual-worktree-git-fix.png) Two more Claude Code releases landed this week, July 19 and July 20, on the heels of the [v2.1.212–214 batch](/posts/claude-code-v2-1-212-214-endconversation-runaway-loop-caps/) this blog covered three days ago. v2.1.215 is a single-line change that quietly reverses a piece of default behavior a lot of teams had gotten used to. v2.1.216 is the more substantial release: a genuine isolation bug fixed in the worktree subagent model, a quadratic performance regression that was stalling long sessions, and a new setting that trades away part of the sandbox for teams that need it. Taken together they're a good example of what "shipping fast" actually looks like for a tool developers give shell and filesystem access to — not big keynote features, but a steady stream of behavioral corrections and boundary fixes. ## /verify and /code-review Stop Running Themselves The entirety of v2.1.215's changelog entry is one sentence: "Claude no longer runs the `/verify` and `/code-review` skills on its own; invoke them with `/verify` or `/code-review` when you want them." That's a bigger deal than the one-liner suggests. Both skills had been auto-triggering — Claude deciding on its own, mid-session, that a change was substantial enough to warrant a verification pass or a review pass, and running one without being asked. That's defensible in principle: it's the same instinct behind auto mode and the broader push toward Claude Code doing more without a human in every loop. In practice it meant unpredictable extra latency and token spend on sessions where a developer didn't want a review cycle yet — mid-refactor, say, with three more edits still coming, not the point to burn a `/code-review` pass that bills separately per PR. Making both skills opt-in again is a small trust-restoring move: it puts a real cost decision (`/code-review` runs $15–25/PR, separately billed from the Claude Code subscription itself) back under explicit developer control instead of an implicit one triggered by Claude's own judgment of "substantial enough." The behavior probably wasn't wrong for every workflow — some teams likely liked getting review passes for free without asking — but silent-by-default is the wrong choice for anything with a per-invocation cost attached, and Anthropic corrected it in a single day-one release rather than letting it linger. ## The Worktree Fix That Actually Matters: git -C, --git-dir, and GIT_DIR v2.1.216's most consequential fix addresses something that undermines a specific safety guarantee Claude Code has been building out for months: git worktree isolation for subagents. When you spawn a subagent with `isolation: 'worktree'` — available via the Agent tool, and load-bearing for any workflow that runs multiple agents against the same repo concurrently — the whole point is that the subagent's git operations stay confined to its own worktree, so a bad edit or command doesn't bleed into your main checkout or another agent's in-flight work. The bug: subagents could redirect git commands into the *shared* checkout instead, via `git -C `, `--git-dir`, or the `GIT_DIR`/`GIT_WORK_TREE` environment variables — all legitimate git flags for pointing a command at a different repository than the one you're standing in. Worktree isolation as a concept assumes the subagent's git commands operate on its own worktree by default; these flags let a command opt out of that assumption entirely, and nothing in the isolation model was checking for it. It's the same category of gap this blog flagged in the [v2.1.212–214 roundup](/posts/claude-code-v2-1-212-214-endconversation-runaway-loop-caps/) three days ago — permission and isolation systems built around what a command *typically* does getting caught out by a flag that changes what it *actually* does — and it's now the second worktree-related fix in eight days, after v2.1.210 patched a related case of isolated subagents running git against the main repo. Two fixes for the same underlying class of problem in one release cycle either means the first patch was incomplete or the surface area is bigger than one fix can cover; either way, it's worth trusting the isolation boundary less than the feature name implies until this pattern of fixes settles down. v2.1.216 also fixes worktree sessions landing in another project's leftover worktree when the working directory didn't match the selected project, and background sessions whose worktree lacked a git repository being permanently un-deletable via `claude rm` — smaller, but the same theme of the worktree abstraction leaking edge cases under real usage. ## sandbox.filesystem.disabled: An Escape Hatch, Not a Regression The other notable v2.1.216 addition is a new setting, `sandbox.filesystem.disabled`, that lets a session skip filesystem isolation entirely while keeping network egress control intact. Read uncharitably, that's a step backward — Claude Code's sandbox model (filesystem isolation plus egress filtering) is one of its stronger security differentiators against IDE-embedded competitors that lean more heavily on trust-the-human-in-the-loop. Read correctly, it's an escape hatch for the teams that already hit friction with filesystem isolation in legitimate workflows — build tooling that expects to write outside the sandboxed tree, monorepo setups where the isolation boundary doesn't line up with the actual working set — and were presumably working around it with less safe configurations already. Keeping network egress control mandatory while making filesystem isolation optional is the right way to offer that escape hatch: it preserves the boundary that stops data exfiltration while relaxing the one that mostly just gets in the way of legitimate file access patterns. Anthropic could have made this a blunt on/off switch for the whole sandbox; it didn't. ## The Performance Fix: Quadratic Growth in Long Sessions Less flashy but immediately useful for anyone running long agentic sessions: v2.1.216 fixes a bug where message-normalization cost grew *quadratically* with the number of turns in a session, causing multi-second stalls and slow resumes the longer a session ran. Quadratic-growth bugs are a specific, recognizable failure mode in agentic tools — anything that re-processes the full conversation history on every turn is a candidate, and it's the kind of regression that's invisible in short test sessions and only shows up once someone's been running Claude Code against a real codebase for hours. Anyone who's felt Claude Code get sluggish deep into a long session over the past few releases now has a specific, named explanation, and a fix. ## What This Batch Says About the Release Cadence Two releases, one day apart, doing three distinct kinds of work — reverting an over-eager default, closing an isolation gap in a feature that's explicitly marketed as a safety boundary, and fixing a scaling bug that degrades the exact long-session, high-autonomy usage pattern Claude Code is built around. None of it is a headline feature. All of it is the maintenance work that determines whether "give an AI agent shell access and let it run" is actually safe to do in practice, as opposed to safe in the product description. That's the metric worth watching release over release, more than any single new command. --- **Sources:** - [Claude Code CHANGELOG.md (GitHub)](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) - [Claude Code changelog docs](https://code.claude.com/docs/en/changelog)