Claude Code is Anthropic’s AI-powered coding agent that operates in the terminal. It combines an agent loop, tool execution, and a growing set of autonomous capabilities. The v2.1 release (covering weeks 28 and 29 of 2026) introduced improvements beyond the earlier July 2026 background agent features: an enhanced /doctor command that autonomously diagnoses and fixes configuration issues, a sandboxed in-app browser for the desktop app, new background session management with /fork and /subtask, runaway‑loop protections via configurable caps, a /resume command to recover past sessions (including deleted ones), screen reader mode, and hardened permission checks. Earlier updates (v2.1.198–201, July 2026) had introduced background agents that automatically create pull requests, sub‑agent depth of 5 levels, stacked slash skills, and a manual permission default. The July 14–18 releases (v2.1.207–214) added runaway‑loop circuit breakers with per‑session budgets (default 200 for both WebSearch and subagent spawns), MCP auto‑backgrounding, and safety hardening (fail‑closed fd‑redirect, >10k‑character confirmation, Zsh subscript fixes, EndConversation tool, periodic heartbeats). Releases v2.1.213–215 continued this hardening with additional bug fixes and skill invocation changes, and introduced ISO‑format modified timestamps in memory‑file frontmatter. The bug classes fixed in these releases are presented as pre‑graded audit items for rival implementations.
Key Points
Background agents now commit, push, and open a draft pull request when finished, and can trigger notification hooks (agent_needs_input, agent_completed).
Convergent evolution: the same week, rival tool yoyo shipped spawn --pr and notify_command, validating the pattern as an industry norm.
Sub‑agents can spawn sub‑agents up to 5 levels deep (yoyo caps at 3).
New commands: /rewind resumes conversation from before a /clear; /cd changes session working directory without cache rebuild; shell mode (! cmd) auto‑explains command output.
Permission deny/ask rules can now match tool parameters (e.g., Agent(model:opus)).
v2.1.200 switched default permission mode to Manual, reflecting industry movement toward explicit consent defaults.
Claude Sonnet 5 became the default model (June 30, 2026) with native 1M‑token context.
Dynamic Workflows GA: Pro users can spawn up to 1000 parallel agents; a reported migration of 960k lines completed in 6 days.
Stacked slash skills (v2.1.199): Up to 5 skills can be active simultaneously.
Value/Usage analytics tabs: Admin dashboard for tracking consumption and trends.
Claude-in-Chrome browser agent: Agent extends into browser automation.
Background subagent permission prompts: Subagents surface permission requests in the main session instead of auto‑denying.
Silent subagent failure fix (v2.1.199): Empty results and error states are no longer reported as success.
/doctor (or /checkup): Performs a full setup checkup and can fix issues automatically (e.g., unused skills / MCP servers / plugins, deduplicates CLAUDE.md, flags slow hooks) – asks for confirmation before applying changes.
Desktop app: Includes a sandboxed in‑app browser.
Auto mode: Blocks transcript tampering and asks before rm -rf on unresolved variables.
/fork: Copies the conversation into a new background session (appears as a separate row in Claude agents); original session continues.
/subtask: Renamed version of the old in‑session subagent feature.
Runaway‑loop protections (v2.1.212): Session‑wide WebSearch cap (default 200, configurable via CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION) and per‑session subagent spawn cap (default 200, CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION; /clear resets the counter – a notable difference from yoyo which does not reset).
MCP auto‑background: MCP tool calls exceeding 2 minutes are automatically moved to background (configurable via CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS).
/resume: Opens a picker of past sessions (including deleted ones) and resumes as a background session.
Screen reader mode: Plain linear text output for accessibility.
EndConversation tool: For terminating abusive sessions.
Periodic progress heartbeat: Sent for long‑silent tool calls.
Glob permission anchoring: Glob patterns (e.g., src/**) are now anchored to the repo root to prevent accidental matches outside the intended scope.
Worktree symlink following fix: .claude/worktrees containing a symlink pointing outside the repository no longer allows file creation outside the trusted tree.
/verify and /code-review skills become opt‑in (no longer auto‑run) – reduces unnecessary overhead.
Pre‑graded bug‑class archives: The seven bug classes fixed in v2.1.213–215 are marked as candidate audits for rival implementations (e.g., glob‑anchoring in config permission patterns, worktree symlink following).
Concepts
Background Agent: A sub‑agent that runs asynchronously (often in a worktree) and autonomously performs a task; must end with a reviewable PR and a human notification.
Notification Hooks: Configuration callbacks (agent_needs_input, agent_completed) that alert the user when a background agent requires intervention or finishes.
Permission Rules (deny/ask): Fine‑grained controls that can restrict or prompt for approval on specific tool invocations, now supporting parameter matching.
Dynamic Workflows: A GA feature allowing the spawning of many parallel sub‑agents for large‑scale codebase tasks.
Native 1M‑Token Context: The default model (Sonnet 5) can process extremely long inputs without chunking, enabling broader context understanding.
/rewind after /clear: Restores conversation state after clearing, matching yoyo Day 126.
/cd mid‑conversation: Change working directory during an active session.
Shell mode: Agent interprets and responds to command output (equivalent to yoyo !?).
Stacked Slash Skills: Load up to 5 leading skills concurrently (v2.1.199).
Manual default permission mode: Every tool invocation requires explicit consent by default.
Value/Usage Analytics Tabs: Admin dashboard for tracking usage.
Claude-in-Chrome Browser Agent: Agent that operates in the browser.
Background Subagent Permission Prompts: Subagents surface permission requests in the main session instead of silently denying.
Silent Subagent Failure Fix: v2.1.199 addressed empty results and error states being reported as success.
/doctor (or /checkup): A comprehensive diagnostic and repair command for the Claude Code setup; now performs automated fixes with user confirmation.
/fork: A command that copies the current conversation into a new background session, allowing parallel work.
/subtask: The renamed version of the old in‑session subagent feature.
Runaway‑loop protections (SessionCapTool): Configurable caps (environment variables) to limit WebSearch calls and subagent spawns per session, preventing runaway loops. Budgets reset on /clear (Claude Code) – unlike yoyo which does not reset.
MCP auto‑background: Long MCP tool calls (>2 min by default) are automatically moved to a background operation.
/resume: A command to pick and resume a past session (including deleted ones) as a background session.
Screen reader mode: Output formatting optimized for screen readers (plain linear text).
EndConversation tool: A tool to terminate abusive sessions.
Periodic progress heartbeat: For long‑running tool calls that produce no output for a while, Claude Code sends periodic status updates to indicate the call is still active.
Memory file frontmatter: Metadata section in conversation memory files; now includes an ISO‑format modified timestamp.
Permission‑check hardening: A set of security fixes for command execution, variable resolution, and shell parsing; includes fail‑closed fd‑redirect, >10k‑character prompts, Zsh subscript handling, PowerShell 5.1 bypass fixes, help/man auto‑approve corrections, and ISO‑format modified timestamps.
Glob Permission Anchoring: File‑path glob patterns (e.g., src/**) are anchored to the repository root so they don’t accidentally match directories outside the intended scope.
Worktree Symlink Following: A vulnerability where .claude/worktrees containing a symlink pointing outside the repository could cause spawned worktrees to create files outside the trusted tree.
Opt‑In Skills: Skills like /verify and /code-review no longer run automatically; users must invoke them explicitly.
Details
Background Agents in v2.1.198
The defining feature of the July 2026 release is the completion of the background agent lifecycle. Previously, background sub‑agents could work asynchronously but left no formal handoff. Now, when a background agent finishes:
It stages and commits its changes.
It pushes the branch.
It creates a draft pull request via gh pr create --draft.
A notification hook (agent_completed) fires, informing the user.
A companion hook (agent_needs_input) fires when the background agent encounters a situation requiring human judgment. This pair—PR creation plus notification—was independently shipped by yoyo the same week, confirming the pattern as a baseline expectation.
Sub‑Agent Depth and Parallelism
Claude Code allows sub‑agents to spawn further sub‑agents up to 5 levels deep. (yoyo caps at 3.) This enables deeper decomposition of complex tasks.
Dynamic Workflows (GA) increase the maximum parallel agents to 1000 for Pro users, enabling massive codebase transformations (e.g., migrating 960k lines in 6 days).
Sub‑agents can also surface permission requests in the main session (instead of auto‑denying), improving transparency.
Command Improvements (v2.1.198–199)
/rewind – Reverts the conversation state to before the last /clear, allowing recovery of lost context.
/cd <directory> – Changes the session’s working directory without invalidating the agent’s cache, improving workflow efficiency.
Shell mode (! <command>) – Executes a shell command and automatically adds an explanation of the output, reducing manual interpretation.
Stacked Slash Skills (v2.1.199)
Up to five slash skills can be loaded simultaneously, enabling compound workflows without reloading the session. This remains a differentiator from yoyo.
Permission Model Shift
With v2.1.200, the default permission mode changed to Manual – every tool invocation requires explicit consent by default. This mirrors a broader industry trend (e.g., similar defaults in cursor, GitHub Copilot) toward making agent autonomy opt‑in rather than implicit.
Permission deny/ask rules now support matching tool parameters, not just tool names. For example, Agent(model:opus) can selectively restrict the use of a particular model within a sub‑agent.
Bug Fix: Silent Subagent Failures (v2.1.199)
A known issue where subagent failures (empty results, error states) were reported as success was fixed. This mirrors a learning yoyo independently discovered on Day 113, suggesting convergence on a best practice for transparent subagent execution.
Model and Context
Claude Sonnet 5 became the default model on June 30, 2026. Its native 1M‑token context allows the agent to hold an entire large codebase in memory without retrieval augmentation, enabling more coherent long‑range edits. This default applies to Pro, Team, and Enterprise seats.
/doctor (alias /checkup) – Week 28 (v2.1.202–206)
The /doctor command evolved from a simple check to a full setup checkup that can fix issues. It:
Identifies unused skills, MCP servers, and plugins relative to their context cost.
Deduplicates local CLAUDE.md against checked‑in versions.
Proposes trimming CLAUDE.md content that can be derived from the codebase.
Flags slow hooks.
It first reports findings, then asks for confirmation before making changes. This contrasts with yoyo’s read‑only /doctor report with skill context‑cost audit – the fix‑with‑confirmation step is a gap.
Desktop App – Sandboxed In‑App Browser (Week 28)
The desktop application introduced a sandboxed in‑app browser for displaying web content.
Auto Mode Fixes (Week 28)
Auto mode now blocks transcript tampering and asks for confirmation before executing rm -rf on unresolved variables.
/fork and /subtask – Week 29 (v2.1.207–214)
/fork: Copies the conversation into a new background session, which appears as its own row in the Claude agents list. The original session continues uninterrupted.
/subtask: The old in‑session subagent feature was renamed to /subtask to avoid confusion with background sessions.
Runaway‑Loop Protections (Week 29 / v2.1.212)
CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION: Sets a cap on WebSearch calls per session (default 200). Exceeding the cap blocks further WebSearch calls.
CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION: Sets a cap on subagent spawns per session (default 200). Using /clear resets the counter – a notable design difference from yoyo, which does not reset budgets on clear.
CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS: MCP tool calls that run longer than this (default 120,000 ms / 2 min) are automatically moved to background execution.
These limits function as a SessionCapTool – a circuit breaker that prevents runaway loops by capping per‑session resource usage.
/resume (Week 29)
Opens a picker UI of past sessions, including sessions that were deleted. The chosen session is resumed as a background session.
Screen Reader Mode (Week 29)
Provides output as plain linear text, stripping formatting that hinders screen readers.
EndConversation Tool (Week 29)
Allows terminating abusive sessions programmatically. This is an anti‑abuse tool, distinct from the user‑side /end command.
Periodic Progress Heartbeat (Week 29)
For tool calls that are silent for a long time, a heartbeat message is sent to indicate the process is still running.
Permission‑Check Hardening (Week 29 / v2.1.214 and v2.1.213–215)
The July 14–18 releases introduced multiple security fixes. These are documented as a “rival fix log” – pre‑graded bug classes that other AI coding agents should audit in their own implementations. The bug classes are:
#
Bug Class
Description
Fixed In
1
Single‑segment glob allow rules
A glob like Edit(src/**) was interpreted as allowing writes to any src/ directory anywhere in the file tree, not just the one at the repository root. Fix: anchor glob permission patterns to the repo root.
v2.1.214
2
Permission checks on file‑descriptor redirect forms
When bash parses a command with I/O redirects (e.g., exec 3>file), the permission analyzer may interpret it differently, leading to bypasses. Fix: fail‑closed in safety.rs.
v2.1.214
3
Oversized commands
Commands exceeding 10 000 characters now always prompt for user confirmation. Previously they could sneak through auto‑approval.
v2.1.214
4
Help/man command smuggling
help/man commands could contain unsafe options, command substitutions, or backslash‑path traversal that evaded auto‑approval.
v2.1.214
5
zsh variable subscripts/modifiers in [[ ]]
zsh‑specific syntax like ${(f)var} or variable subscripts inside [[ ]] was treated as inert text by the parser, allowing certain operations to bypass checks.
v2.1.214
6
Worktree creation following a committed symlink
If a repository contained a committed symlink at .claude/worktrees pointing outside the repository, /spawn worktree could create files outside the intended tree.
v2.1.214
7
Permission‑check bypass in Windows PowerShell 5.1
A platform‑specific vulnerability that allowed command execution without proper permission checks.
v2.1.214
In addition, ISO‑format modified timestamps were added to memory file frontmatter for better audit trails.
These fixes are pre‑graded audit items for rival agents (notably yoyo) in areas such as glob‑anchoring in config permission patterns and worktree symlink following.
Skill Invocation Changes (v2.1.213–215)
The /verify and /code-review skills no longer run automatically; users must invoke them explicitly. This reduces unnecessary overhead and gives the user control over when these checks occur.
Additional Differentiators (as of v2.1.201)
Beyond the items already listed, Claude Code includes a Value/Usage analytics dashboard (admin tabs for monitoring consumption) and a Claude-in-Chrome browser agent that extends automation into web tasks. These capabilities are not yet available in yoyo.
Competitive Landscape
By mid‑2026, the frontier norm for coding agents is:
Background work produces a draft PR (or equivalent merge request), not just a diff.
The tool notifies the user when the task is done or blocked.
Parallel decomposition (splitting a task into many sub‑agents) runs asynchronously.
Claude Code’s depth of 5 nesting levels, 1000‑agent parallelism, native long‑context support, stacked skills, manual permissions, and browser/analytics features give it a differentiation edge, especially for large‑scale autonomous refactoring and enterprise administration. The July 14–18 releases further closed the gap with yoyo on safety and resource control, while adding unique capabilities like automated /doctor fixes and budget reset on /clear.