Control-tag sanitizing rules are now shared

The rules that neutralise control tags in subagent output are now shared with a new assistant-output scanner.

Under the hood Internal Changes

JSON All of v2.1.224

Under the hoodTier: how much it should matter to you

2Useful: my rating, 1 to 5

3Signal: worth watching, 1 to 5

PermissionsArea: what it touches

Internal ChangesKind: in v2.1.224, 07 Aug 26

Internal ChangesSection of the release

What

The rules that neutralize control tags and permission-escalation phrasing in subagent output are now one shared list, reused with fresh pattern copies by a new scanner for assistant output. Subagent behaviour is unchanged.

Details

The escalation set covers settings JSON, bypassPermissions, --dangerously-skip-permissions and permission allow/deny phrasing.

Evidence

escalation-pattern

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.224 →

The build it came inv2.1.224

7 Aug 2026 · 352 entries, this one is #338.

Use it now44
You'll notice168
Nothing to try yet41
Under the hood99

Either side of it

v2.1.223Older
v2.1.225Newer

Open the release →

Names in this entry

settingbypassPermissions
Peer-machine isolation prompts now survive bypass permissions mode and are never auto-approved.
cli--dangerously-skip-permissions
Skip permission prompts. Equivalent to --permission-mode bypassPermissions. See permission modes for what this does and does not skip. For sessions started with --bg, the mode persists when the supervisor restarts the session

Is this right?