Claude Code v2.1.205 Blocks Auto-Mode Transcript Tampering and Prompts Before rm -rf on Unresolved Variables
v2.1.205 (July 8, 2026) shipped 23 CLI changes, headlined by two auto-mode safety rules: the agent is now blocked from tampering with session transcript files (preserving conversation integrity as an audit artifact), and auto mode prompts before executing rm -rf on unresolved shell variables — the classic `rm -rf $UNSET/` footgun. Bug fixes include --json-schema silently producing unstructured output when the schema was invalid, messages sent mid-turn being silently lost at the --max-turns limit, Windows worktree removal deleting files outside the worktree when an NTFS junction or directory symlink lived inside it, and background agents staying stuck as 'failed'/'completed' in the agent list after resume via SendMessage. The transcript-tampering rule is the notable one: it treats the agent's own log as a protected resource, which matters for anyone using transcripts as the evidence trail in a self-improving harness.
↳ Follow the thread