Claude Code 2.1.212 Closes a Plan Mode Bash Escape

Claude Code 2.1.212 fixes a bug where plan mode didn't actually block file-modifying Bash commands from running, per the Claude Code changelog. Plan mode exists so you can review a proposed set of changes before anything touches disk. If a Bash command could mutate files during that review step, the core guarantee of the mode was broken.

The practical risk is narrow but real. Anyone running a version before 2.1.212 who trusted plan mode as a safe preview could have had files altered mid-plan. They wouldn't have seen the permission prompt they expected first. If you script around Claude Code or run it unattended, that's the difference between nothing happening until you say so, and something already happening.

The same release also fixes a separate bug. SIGTERM could orphan process trees in print and SDK mode, leaving child processes running after a kill. Different bug, same theme: the tool doing something after you told it to stop, or before you told it to go.

What to do

Upgrade to 2.1.212 if you use plan mode as a gate before approving changes, especially in automated or unattended setups. The changelog doesn't say how long the bug existed before this fix. It also doesn't say how many commands were affected, so there's no way to know if past plan-mode sessions were exposed.

Earlier entries in the same changelog hardened other parts of the permission surface. Version 2.1.210 tightened the Agent tool against indirect prompt injection and, separately, stopped worktree-isolated subagents from running git-mutating commands against the main repo. Permission and isolation bugs are the pattern this cycle, not new features.