Claude Code 2.1.183 blocks destructive git/tf/pulumi/cdk destroy unless requested

• ClaudeCodeLog's release post says Claude Code 2.1.183 adds a new auto mode guardrail that blocks destructive git commands unless the user explicitly asks to discard local work, and the changelog thread extends that pattern to terraform destroy, pulumi destroy, and cdk destroy unless the specific stack was requested.
• ClaudeCodeLog's highlights and the full changelog both call out a new attribution.sessionUrl setting that strips Claude session links from commits and PRs, closing an easy way to leak internal URLs.
• According to the changelog, scheduled tasks and webhooks are now classified as notifications instead of keyboard input, which means they can no longer approve pending actions or set the session title in auto mode.
• The same changelog also fixes several long-run agent failures: silent turns when the model returned only a thinking block, empty WebSearch results in subagents, auth-stub MCP tools leaking into headless mode, and Windows Terminal corruption under nested subagent load.
• ClaudeCodeLog's follow-up adds one more cleanup detail: the release removes the migrate command, drops CODEX_HOME and GEMINI_HOME, and deletes gemini-extension.json, all less than two hours after 2.1.182.

You can [browse the full changelog via ClaudeCodeLog's source link]here, skim [ClaudeCodeLog's removal list]the extra diff notes, and LLMpsycho's summary post is a good one-screen version if you only care about the headline fixes.

The biggest change is not a new capability. It is a narrower definition of what auto mode is allowed to destroy.

According to the changelog, Claude Code now blocks git reset --hard, git checkout -- ., git clean -fd, and git stash drop when the user did not ask to discard local work. The same rule now covers infra teardown commands: terraform destroy, pulumi destroy, and cdk destroy are blocked unless the request names the specific stack.

LLMpsycho's release note compresses the same point into one line, which is probably how most users will experience this update: fewer ways for an agentic run to wipe code or nuke infrastructure because a prompt was underspecified.

Two smaller changes target the edges where automation touches external systems.

First, the changelog adds attribution.sessionUrl, a setting that omits the Claude session link from commits and PRs in web and Remote Control sessions. That matters because those links are convenient provenance, but they can also expose internal session URLs in repos or review systems.

Second, the same changelog says scheduled task and webhook deliveries are no longer treated as keyboard input. They are now notifications, so they cannot approve a pending action or set the session title in auto mode.

Most of the rest of 2.1.183 is stabilization for longer, messier sessions.

The changelog lists fixes for thinking.disabled.display 400 errors during subagent spawns and session-title generation, empty WebSearch results in subagents, and turns that completed with no visible output when the model returned only a thinking block. Claude now re-prompts once in that last case.

It also patches interface and orchestration issues that show up under load: Windows Terminal fullscreen corruption with heavy nested subagents, vim-mode cursor placement bugs, duplicate user-level skills in slash-command autocomplete, tmux teammate panes that failed when shell init was slow, and background tasks started by a teammate getting killed when that teammate finished a turn, all per the same thread.

ClaudeCodeLog's follow-up says 2.1.183 also removes the migrate command, drops the CODEX_HOME and GEMINI_HOME environment variables, and deletes gemini-extension.json. The package shrank by 42.5 kB, while prompt file count and prompt token mix stayed flat.

One useful meta-detail in that same post is timing: 2.1.183 shipped 1 hour, 53 minutes, and 32 seconds after 2.1.182. Paired with ClaudeCodeLog's earlier 2.1.179 teaser, it reads like a very active patch train rather than a one-off hotfix.