Claude Code 2.1.216: Worktree Git Isolation Escape Patched and Quadratic Session Slowdown Fixed

Two of the highest-impact fixes in Claude Code 2.1.216 hit the same pressure point for operators running parallel agentic workloads: git isolation that could be circumvented and session performance that collapsed under load. If your team runs multi-worktree subagent pipelines or long-horizon agentic sessions, both patches directly affect your deployment posture.

What 2.1.216 fixes

Worktree subagent git isolation escape — closed. Worktree-isolated subagents could redirect git operations back into the shared parent checkout by passing git -C <shared-path>, --git-dir, or the environment variables GIT_DIR and GIT_WORK_TREE. The fix blocks these escape vectors so each subagent's git scope is now genuinely restricted to its own worktree. This is distinct from CVE-2026-55607 (published July 16), which addressed a broader sandbox escape advisory; this patch targets the specific env-var and flag bypass pattern inside worktree isolation.

Quadratic session slowdown — eliminated. Message normalization cost was growing O(n²) with the number of turns. In practice, sessions with 50 or more turns experienced multi-second stalls and slow resumes as each new message triggered a full re-scan of the growing message history. The fix makes normalization linear. Teams running long-horizon coding agents — architecture reviews, multi-file refactors, repository-wide migrations — will see the biggest benefit.

sandbox.filesystem.disabled — new operator setting. You can now disable filesystem isolation while keeping network egress controls intact. This is useful for agents that need broad filesystem access (monorepo traversal, build system integration) but should still have their outbound network traffic governed. Previously, the two were coupled; now they can be tuned independently.

Additional fixes operators should note:

• Auto-mode commands were being denied with HTTP 401 classifier errors after an OAuth token expired or rotated mid-session. Fixed. Relevant to gateway setups that surface Claude Code behind an OAuth-secured endpoint.
• Background subagents were being cancelled during their startup window when a high-priority message arrived. Fixed. This affected parallel agent architectures where a primary agent spawns background workers and then immediately sends follow-up messages.
• Resumed background agent sessions were reverting to the default agent, dropping the original prompt and tool restrictions. Fixed. A critical correctness bug for managed-agent deployments.
• Worktree sessions were landing in another project's leftover worktree when the working directory did not match the selected project. Fixed.
• The Prometheus metrics endpoint (OTEL_METRICS_EXPORTER=prometheus) was emitting invalid # UNIT lines. Fixed. Affects operators using Prometheus scraping for agent observability.
• Telemetry was misreporting permission denials: failed permission-prompt requests were counted as user rejections, and user interrupts were reported as rejections instead of aborts. Fixed. This skewed operator dashboards tracking approval rates and refusal patterns.

The operational impact on agentic pipelines

The git isolation escape is the most operationally sensitive item. Operators who use worktree isolation to run parallel subagents on separate branches — for feature development, code review, dependency upgrades — may have inadvertently allowed agents to write commits back into the shared checkout. In a CI/CD pipeline or a team-governed agent environment, that means unintended cross-contamination of work in progress. The fix eliminates the bypass vector, but operators should audit any worktree-based automation that has already run to check for unexpected commits in shared branches.

The quadratic slowdown fix matters for a different reason: it directly affects the economics of long-horizon tasks. If a session with 80+ turns was stalling for three to five seconds per message, that latency was compounding across every agent turn. For operators billing on time-to-completion or running multiple concurrent sessions, the fix reduces effective cost and improves throughput without any configuration change.

sandbox.filesystem.disabled is a capability expansion that previously required a workaround: operators who needed agents to access a broad filesystem had to either disable the sandbox entirely (losing network controls) or structure the task differently. The new setting gives a more precise control surface.

Operator audit checklist

Parallel worktree subagent pipelines should be treated as the highest-priority item in your 2.1.216 upgrade checklist. Before updating, audit recent commits in shared checkouts that were produced by worktree-isolated agents. After updating, verify that your agent harness passes clean working directories — the secondary fix that catches stale-project worktree mismatches will help here too.

Long-session agentic workloads should see measurable throughput improvements with no configuration change required. If you track turn-to-turn latency as an observability metric, expect the numbers to drop materially in sessions that previously hit the 50+ turn threshold.

Gateway operators using OAuth flows for Claude Code authentication should verify that the mid-session token expiry fix behaves correctly in your environment. Previously, a token rotation mid-session silently broke auto-mode approval chains; the fix restores clean re-authentication.

Observability teams using Prometheus to scrape Claude Code metrics should pull the update to get valid # UNIT lines and corrected permission-denial telemetry. If your approval-rate dashboards looked anomalously low, this may explain the discrepancy.

What this means for TheRouter gateway users

Teams routing to Claude Code through TheRouter's gateway benefit from these reliability fixes propagating through the underlying agent runtime. The quadratic slowdown fix reduces per-session latency for long-horizon tasks, which in turn reduces the total token window consumed during stalls. The background subagent cancellation fix improves the success rate of parallel agent launches initiated through orchestrated workflows.

For operators configuring worktree isolation: review your agent harness settings against the operator governance docs to ensure your sandbox configuration reflects the new sandbox.filesystem.disabled decoupling.

Update to 2.1.216 via your standard Claude Code upgrade path before running any new worktree-based pipeline.