Claude Code v2.1.221 ·
Deny rules are checked against every form of a path
Your deny rules now block a path even when it's written a different way.
You'll noticeTier: how much it should matter to you
4Useful: my rating, 1 to 5
0Signal: worth watching, 1 to 5
PermissionsArea: what it touches
Bug FixesKind: in v2.1.221,
What probably matters to youSection of the release
What
A deny rule now matches even when the path is written in a form other than the one that got resolved.
Details
- the deny lookup iterates over the path's variants and returns the first matching rule, instead of testing only the single resolved path
- the drive-relative rejection message now names the original argument when one is available
- drive-relative paths still require manual approval because they resolve against the per-drive current directory
Evidence
is drive-relative (resolves against the per-drive current directory, which cannot be statically validated) and requires manual approval
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
See this entry in the whole of v2.1.221 →
