Daily · · Claude Code · BackfilledAdded after launch from the official source. · 🌶️🌶️Medium: worth a look this week Why: Permission rules hold
Claude Code closes gaps in your deny rules
Your deny rules stop slipping through side doors. The latest Claude Code release applies Bash deny and ask rules behind environment variable prefixes, holds them on nested parts of compound commands on managed machines, and applies Read deny rules to files reached through a symlink.
In plain English
A deny rule you wrote should stop the command every time, not only when it is typed the plain way.
Claude Code lets you write permission rules: "deny" blocks a command or file outright, "ask" makes Claude check with you first. The latest release fixes several ways those rules could be skipped:
- A Bash deny or ask rule now catches a command behind an environment variable prefix with an expanded value, such as
TZ="$HOME" rm -rf build, when the sandbox auto-allows commands. It also holds when a bare variable assignment comes before the command. - On managed machines, a deny or ask rule on a nested part of a compound shell command now holds over a user-installed mod’s approval.
- Read deny rules now apply to files that are @-mentioned, changed or selected in the IDE through a symlink.
- A user-installed plugin can no longer rewrite the descriptions of an organization-managed MCP server’s sign-in tools.
What to do
Update Claude Code to 2.1.289 or later. Your existing rules start covering these cases without any edits.