Under the hoodTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
PermissionsArea: what it touches
Internal ChangesKind: in v2.1.235,
Internal ChangesSection of the release
Every dialog that can persist a permission rule (Bash prefix/exact, Chrome host, Skill exact/prefix, plan-mode exit keep-context rows, and MCP elicitation) now produces its label and the permissionUpdates it applies together through a single mint function, and consumers check the row before applying it. If a row wasn't produced this way, the dialog falls back to a one-time allow with no persistent rule written; the mint step also deep-freezes its input and rejects getters, symbols, and non-plain prototypes.
Separately, untrusted strings shown in these dialogs (MCP server/tool names, elicitation URLs, commands, skill and cell names, question labels) now pass through a sanitizer that can withhold display entirely, showing "approval withheld; one-time options only" instead. When a value is withheld, persistent options are dropped, and for the elicitation URL dialog the default choice becomes "decline" and the URL cannot be opened. This applies to everyone.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeImproved permission dialogs: display text and "don't ask again" options now always match what a grant would cover, and "don't ask again" is…
