clauding.de
DE
• 3 min read AI-generated

Claude Code 2.1.216: Auto Mode Can No Longer Throw Away Your Work

Copy article as Markdown

Two releases in two days. Auto mode now blocks destructive commands — 'git reset --hard', 'terraform destroy' and friends only run if you actually asked for them. Plus subagent streaming and a worktree guard that rescues unpushed commits.

Claude Code Security Update
Featured image for "Claude Code 2.1.216: Auto Mode Can No Longer Throw Away Your Work"

Claude Code 2.1.216 is out — and once again it’s not a glamorous feature drop but the kind of release you only learn to appreciate when it saves your day. Together with 2.1.215 from the day before, this one is about a topic that bites hard in auto mode: destructive commands.

Auto mode learns caution

If you run Claude Code in auto mode, you know the uneasy feeling: the model works on its own, and somewhere lurks the one command that wipes local work for good. That’s exactly where 2.1.216 steps in. From now on, destructive git commands are blocked unless you explicitly said you want to discard local changes:

  • git reset --hard
  • git checkout -- .
  • git clean -fd
  • git stash drop

On top of that, git commit --amend is stopped when the commit in question wasn’t made by the agent in this session — you shouldn’t accidentally rewrite someone else’s history. And because the problem doesn’t end at git, the same logic applies to infrastructure: terraform destroy, pulumi destroy and cdk destroy only run when you asked for that specific stack.

That’s the right instinct. An agent that works autonomously for hours needs guardrails precisely where a single command can’t be undone.

Subagent streaming and a worktree that thinks along

2.1.215 was mostly about reliability. Subagents now stream their text — so you see live what a delegated task is doing instead of waiting for the final result. For anyone who leans on subagents and background sessions, that’s a real gain in transparency.

But my quiet favourite is buried in the fine print: an older daemon no longer silently restarts workers on the old binary that a newer version spawned. And Ctrl+X now deletes renamed-branch worktrees — while never destroying unpushed commits. Details like that decide whether a tool feels trustworthy or whether you hold your breath at every keystroke.

Small things on the side

  • The stream-stall hint now reads “Waiting for API response · will retry in …” instead of the alarming “No response from API” — and only shows up after 20 seconds of silence rather than 10.
  • There’s a new warning when you’re using a deprecated or auto-updated model.
  • The attribution.sessionUrl setting and a /config --help were added.
  • Plus the usual handful of fixes across permissions, uploads, sessions, Chrome and Windows.

My take

Two releases, one clear thread: the more autonomously Claude Code works, the more the brakes matter. What I like is that Anthropic doesn’t block blindly here — it ties the decision to intent. If you asked for the discard, it runs; if the agent came up with it on its own, it asks.

That’s the difference between a tool that trusts you and one that protects you from yourself. Both are fine. What matters is that the line sits where it hurts — and now it does.

Sources: