Claude Code v2.1.219 ·
Admin-workspace helpers get a random per-run token and path guards
Admin workspace helpers gained a random run marker and stricter name and path-traversal checks.
Under the hoodTier: how much it should matter to you
1Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
ElsewhereArea: what it touches
In DevelopmentKind: in v2.1.219,
In DevelopmentSection of the release
The marker and validation patterns exist, but whether any of it is reachable for users could not be resolved.
What
Admin-workspace helper code gained a per-run marker and input validation patterns, with no confirmed user-facing surface in this build.
Details
- A module initialiser builds a random
zzadminwc-prefixed marker from 8 random bytes. - New regexes reject characters such as
/, @, #, ?, \ and whitespace in names. - A separate pattern catches dot-segment path traversal, including the
%2e encoded form. - Whether any of this is reachable for users could not be resolved.
Evidence
zzadminwc
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
See this entry in the whole of v2.1.219 →
