Claude Code 2.1.212 fixes a plan-mode permission bypass

Claude Code patched a plan-mode bypass in v2.1.212, where file-modifying Bash commands could run without hitting the permission gate, per the changelog. That defeats plan mode's purpose: a read-only review step before you approve any changes. If you're on an older version, upgrade before you trust it again.

The same release fixes SIGTERM orphaning process trees in print and SDK mode, so background runs actually clean up when killed.

The quieter change points somewhere more interesting: hard per-session ceilings. The release adds a WebSearch cap, 200 by default and tunable via CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION, plus a subagent-spawn cap set the same way, CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION, reset with /clear. Any MCP tool call running past two minutes auto-backgrounds, so the foreground session stays usable.

I've had agents in my personal projects spiral quietly. A subagent spawns a subagent, and that one re-searches the same query five times. I only find out when I check token usage after the fact. Avoiding that used to be on me to remember. These caps make it a configurable property of the harness instead, which is where it belongs. Proxy and compression tools like rtk and headroom are chipping at the same cost problem from outside the tool. The direction is clear: agent spend is becoming something you declare a limit on, not something you hope stays reasonable.

One muscle-memory break: as of this release, /fork copies your conversation into a background session, and the old in-session fork behavior moved to /subtask. If you have workflows that used the old binding, rebind before it surprises you mid-task. Set your caps explicitly and watch what gets dropped when you hit one. That tells you whether it's protecting you or just cutting off real work.