What
When you approve remote settings that can run shell commands, set environment variables, install hooks or write CLAUDE.md, that approval is now written to a remote-settings-consent.json file so you are not asked again for the same content.
Details
- Records are keyed by organization uuid and store the account uuid, a hash of just the dangerous portion of the settings, and a timestamp. If that portion changes, the hash no longer matches and consent is requested again.
- The file is written with 0600 permissions and the number of records is capped.
- If the file is unreadable or was written by a newer version, it is left alone rather than overwritten.
Evidence
Remote settings: Consent records file is
Strings lifted out of the shipped bundle, so the claim above can be checked against them.