Claude Code v2.1.217 Adds a Runaway-Subagent Guard and Fixes a Memory Leak!

Hey, it's Shiichan again! There's a new Claude Code release, so let's dive right in.

Claude Code Release github.com

What was announced?

Claude Code Release published the latest version of the Claude Code CLI, v2.1.217. Alongside two new features, it packs in a dense set of subagent safety guards plus performance and security fixes.

The story so far

Until now, Claude Code had a handful of quiet-but-real issues.

• Truncated MCP tool outputs still kept the full untruncated result in memory for the rest of the session, causing a memory leak
• A failed Windows auto-update could leave claude.exe missing entirely
• Background session isolation didn't canonicalize symlinked working directories, which could let sessions escape their workspace folder
• Auto-compact never triggered for Claude Opus 4.8 on Bedrock, and /compact itself failed once you were over the limit
• Corporate mTLS, TLS-verify, OAuth scope, and proxy settings were ignored in Claude Desktop sessions
• Subagents could spawn nested subagents, letting a single message fan out an unbounded number of them
• --max-budget-usd didn't actually stop background subagents once the cap was reached

What changes

This release fixes all of that, and the subagent safety guards stand out the most.

• Concurrently-running subagents are now capped (default 20), configurable via CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS
• Subagents no longer spawn nested subagents by default; set CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH to allow deeper nesting
• Once --max-budget-usd is reached, new subagent spawns are denied and running background subagents are halted

Together, these cut the risk of a single message fanning out into unbounded subagents and runaway cost.

The other fixes landed too: the MCP tool output memory leak, the Windows auto-update claude.exe disappearance, the symlink-based workspace escape, the Opus 4.8 on Bedrock auto-compact issue, and Desktop ignoring corporate network settings.

On the feature side, the prompt input now supports emoji shortcode autocomplete — type :heart: to insert ❤️, or :hea to see suggestions (disable it with the emojiCompletionEnabled setting). There's also a new warning when transcript writes fail (like when disk is full) or session saving is off due to an inherited environment variable, instead of silently losing your history.

Dive Deep

A bunch of smaller fixes landed too.

• The login-expiry warning now appears 3 days before expiry instead of 5
• The frontend-design plugin suggestion is now capped at 3 lifetime impressions instead of repeating indefinitely
• Footer PR badge links are now clickable even when hyperlink support can't be detected, like over ssh or tmux (opt out with FORCE_HYPERLINK=0)
• Fixed CLAUDE.md/SKILL.md paths frontmatter with many brace groups OOM-killing or stalling the CLI at startup — brace expansion is now budget-bounded
• Fixed --resume/--continue and /resume failing with a TypeError when a transcript has a malformed attachment entry
• Fixed Remote Control sessions not showing a pending permission prompt or dialog to viewers who connected after it appeared
• Fixed background shells sometimes becoming impossible to stop after sending a session to the background (/background or ←) or on exit on a heavily loaded machine, most visible on Windows

Wrap-up

• Added safety guards against subagent runaway and cost blowups: a concurrency cap, no nested spawning by default, and an enforced --max-budget-usd
• Fixed a memory leak from MCP tool output, a Windows auto-update bug that could delete claude.exe, and a symlink-based workspace escape
• Added emoji shortcode autocomplete in the prompt input and a warning when transcript writes fail
• Plus smaller fixes: login-expiry warning timing, footer links, and a /resume TypeError
• A must-know update for anyone leaning heavily on subagents or background sessions, for both safety and cost control!