Claude Code v2.1.169: Safe Mode, /cd Command, and a Pile of Bug Fixes

Claude Code v2.1.169 landed on June 8, 2026 with 30 CLI changes, and while the headline features are small in number, they solve some genuinely frustrating problems. If you use Claude Code on Windows, run it in an enterprise environment, or have ever spent time wondering whether a weird bug was caused by your config or the tool itself, this release has something for you.

A Clean Slate for Troubleshooting: --safe-mode

The new --safe-mode flag (also available as the CLAUDE_CODE_SAFE_MODE environment variable) starts a session with every customization layer stripped out. That means no CLAUDE.md, no plugins, no skills, no hooks, and no MCP servers.

If you have ever hit a confusing error and spent twenty minutes working out whether it was your project config, a plugin, or Claude Code itself causing the problem, this flag cuts straight to the answer. Start with --safe-mode, reproduce the issue, and you know it is a tool bug. Does not reproduce? Start re-enabling layers one at a time until you find the culprit.

It is the kind of thing that sounds obvious once it exists, but was genuinely missing before.

Changing Directory Without Breaking Your Session: /cd

The new /cd command lets you switch working directories mid-session while preserving the prompt cache.

That second part matters. Normally, changing context in a session would invalidate the cached prompts, forcing the model to re-process everything it has already seen. Claude Code’s /cd implementation is engineered specifically to avoid that, so you can move between directories in a long session without paying a performance penalty or losing the context the model has already built up.

For developers working across monorepos or projects with multiple sub-directories, this is a practical quality-of-life improvement. Previously, switching directory mid-session was awkward enough that starting a fresh session was often the easier choice.

Hiding Built-in Skills: disableBundledSkills

A new disableBundledSkills setting (with a matching CLAUDE_CODE_DISABLE_BUNDLED_SKILLS env var) hides Claude Code’s bundled skills, workflows, and built-in slash commands from the model entirely.

This is primarily aimed at teams deploying Claude Code in controlled or minimal configurations, where you want precise control over what the model can do and do not want it reaching for built-in behaviours that might not suit your environment. Enterprise platform teams building on top of Claude Code will likely find this useful for standardising deployments.

Background Agent and Enterprise Fixes Worth Knowing About

The bug fix list is long, but a few items stand out depending on how you use Claude Code.

Background agents ignoring project settings. When a background agent was dispatched onto a pre-warmed worker, it was ignoring project-level env values, including things like ANTHROPIC_MODEL. So your carefully configured settings were silently not applying. That is now fixed.

Enterprise MCP policy enforcement. If your organisation uses allowedMcpServers or deniedMcpServers to manage MCP access, those policies were not consistently enforced in several situations: on reconnect, with IDE-entered configs, with --mcp-config servers during the first session after install, and before remote settings had finished loading. All of those gaps are closed in this release. There was also a cold-start performance issue for organisations without remote settings configured, which is fixed too.

Remote Control reconnection. A specific but annoying bug where Remote Control would get stuck showing “reconnecting” after a session resumed at the same time as an OAuth token refresh has been resolved.

Windows claude -p hang. A regression introduced in v2.1.161 was causing claude -p to slow down or appear to hang on Windows because it was waiting on slash-command and skill scans. Fixed.

macOS UI stall. Users logged in with claude.ai credentials on macOS were seeing a 30-50ms UI stall at the start of each turn. Small, but noticeable if you are sensitive to responsiveness. Fixed.

WSL/Windows Terminal display glitch. The agents view was leaving a stale or garbled frame after navigating back from an agent on WSL in Windows Terminal. Also fixed: the MCPB plugin cache was being spuriously invalidated on Windows, causing unnecessary re-extraction on startup.

A Security Fix Worth Noting

One item in the security category: untrusted project settings could previously set OpenTelemetry client certificate paths without requiring trust confirmation. That is now blocked. It is a narrow attack surface, but the kind of thing that matters in environments where project files might come from external or untrusted sources.

What Changed for claude agents

The claude agents --json command got a quiet but useful update. It now omits blocked and just-dispatched background sessions from the default output to reduce noise, and a new --all flag brings back completed sessions when you need the full picture. The output also gains id and state fields, making it more useful for scripting and automation on top of Claude Code.

The Bigger Picture

This release does not introduce anything that will change how most people think about Claude Code. What it does is make the tool more reliable in the places where it was quietly misbehaving: Windows environments, enterprise policy enforcement, background session management, and session handling edge cases.

The --safe-mode flag is the kind of feature that will save disproportionate amounts of time when you actually need it. The /cd command removes a small but real friction point. And the enterprise MCP fixes address gaps that would have been difficult to even diagnose without knowing exactly what to look for.

For the full changelog, the Claude Code releases page on GitHub has the complete list of changes.

---

Updates to this story

19 July 2026: Claude Code v2.1.214–215: broad permission-hardening update fixes PowerShell bypass, dir/** path confusion, and /verify auto-run

Two rapid-fire releases on July 19 push Claude Code’s security posture significantly further than v2.1.169’s session-level protections, moving into the runtime permission engine itself.

The headline fix in v2.1.214 is a permission-check bypass in Windows PowerShell 5.1 sessions that allowed commands to execute without triggering the expected approval flow. Windows users on PS5.1 should update immediately. Alongside this, single-segment dir/** allow-rules (such as Edit(src/**)) were incorrectly auto-approving writes to matching directory names anywhere deeper in the project tree, not just <cwd>/src. Anyone relying on scoped write permissions should audit their rules after updating.

The release also hardens several additional bash permission edge cases: file-descriptor redirects, commands over 10,000 characters, zsh variable subscripts in [[ ]] comparisons, and certain help and man invocations that could carry unsafe options now all prompt rather than auto-approve.

v2.1.215 changes /verify and /code-review to run only when explicitly invoked. Previously Claude could trigger these autonomously mid-session, which caused unexpected interruptions in agentic pipelines.

Where v2.1.169 addressed what happens at session startup, these releases govern what Claude actually executes once a session is running. The official changelog has full detail on all edge cases patched.

13 July 2026: Claude Code security hardening: auto mode blocks transcript tampering and background notifications prevent fabricated approvals

Claude Code v2.1.205 adds two targeted agentic security fixes that close gaps the existing auto mode classifier architecture could not address on its own.

Auto mode now blocks transcript writes. The .jsonl session history files under ~/.claude/projects/ are no longer writable by Claude in auto mode, whether directly or via a shell command. The protection also covers the metadata lines Claude Code appends to each transcript entry. The concern is concrete: a prompt-injection payload that writes directly to a transcript file could insert a fake human approval that a later session, or a downstream agent resuming the session, acts upon. Auto mode’s classifier is reasoning-blind by design, so it cannot catch this from the inside. The new file-write rule closes the gap from the outside.

Background task notifications now explicitly deny fabricated approvals. Notifications from background tasks state that no human input has occurred during that task, so a fabricated “user approved” line inside a transcript cannot be treated as a real approval by downstream agents. Approval must arrive through the actual approval channel.

Both rules are on by default in auto mode and require no configuration. See the v2.1.205 release notes for the full changelog, which also includes fixes for lost messages at the --max-turns limit, Windows worktree file deletion, and broken JSON schema output.

12 July 2026: Claude Code background subagents now run in parallel by default and ship a draft PR when finished

Two releases since this post — v2.1.197 (June 30) and v2.1.198 (July 1) — significantly extend what subagents can do on their own.

Subagents now run in the background by default across every spawn type. The main session keeps working and receives a notification when each agent finishes. Set CLAUDE_CODE_DISABLE_BACKGROUND_TASKS=1 to revert to synchronous behaviour if needed.

The bigger change landed in v2.1.198: background agents running inside Claude-created git worktrees now automatically commit their changes, push a branch, and open a GitHub draft PR when they finish — no prompt, no pause. The safeguards are deliberate: agents never push to main or master, never force-push, and never merge. The PR is draft by default, keeping the merge decision with a human. Agents in other checkout modes still follow normal permission prompts.

Two new Notification hook events — agent_needs_input and agent_completed — let you wire background agent lifecycle into Slack or desktop alerts. The worktrees docs cover the isolation model that makes parallel agent runs safe.

Additional changes in these releases: the Explore agent now inherits the main session model rather than defaulting to Haiku, and subagents inherit the session’s extended thinking configuration.

12 July 2026: Claude Desktop for Linux is now in beta on Ubuntu and Debian with full Chat, Cowork, and Claude Code support

Anthropic shipped a public beta of Claude Desktop for Linux on 30 June 2026, changing the picture for Linux developers who previously had to rely on the Claude Code CLI or browser to access Claude. The native app brings the same Chat, Cowork, and Claude Code experience available on macOS and Windows to Ubuntu 22.04+ and Debian 12+ on x86_64 and arm64.

The Claude Code tab inside the desktop app gives Linux users parallel sessions, visual diff review, an integrated terminal and editor, and MCP support for connecting to local files, databases, and tools. A paid subscription (Pro, Max, Team, or Enterprise) is required for the Code tab. Fedora and other non-Debian distributions are not officially supported yet.

Two features are absent from the beta: Computer Use and voice dictation. Anthropic has confirmed Computer Use is coming to Linux but has not given a date. The Quick Entry global hotkey works on X11 but has incomplete support under native Wayland.

Anthropic recommends installing via their apt repository so updates arrive through your package manager rather than downloading the .deb directly. Full install instructions are in the official Linux documentation, and the app is available from claude.com/download.

2 July 2026: Claude Code gets Claude in Chrome as GA, background agents that auto-open draft PRs, and a /dataviz skill

Claude Code has shipped several significant additions since the v2.1.169 release covered below. The bug fixes and workflow improvements from that release remain accurate, but the headline features have moved on.

The biggest workflow change: background agents running in a worktree now commit, push, and open a draft pull request automatically when they finish, closing the last manual handoff in unattended coding runs. Alongside this, background agent sessions now fire the Notification hook (agent_needs_input / agent_completed), so alerting pipelines can respond without polling. Subagents also now run in the background by default for all users, not just those in the earlier rollout group.

Claude in Chrome moves from beta to general availability. The browser extension lets Claude read pages, click, and navigate alongside you, and connects directly to Claude Code for testing and debugging web apps without switching contexts. Note that Chrome integration requires a claude.ai account and does not work through Bedrock, Vertex, or other third-party providers.

Other additions worth knowing: a /dataviz skill for chart and dashboard design guidance is now built in, the Gateway upstream provider list now includes Claude Platform on AWS (anthropicAws) with improved failover, and the Explore agent now inherits the main session model instead of defaulting to Haiku.

Run claude update to get the latest version, and claude --version to confirm. The official changelog has the full details.