Source Intelligence

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

All of v2.1.238 Home All releases olderv2.1.237 v2.1.239newer
Claude Code v2.1.238

Remote requests to change the working directory reject network paths

You'll notice
Useful2 Signal2
Permissions

Remote requests to change your working directory now refuse network paths and hidden-character tricks.

What

A request from a remote host to set the working directory is now screened for path shape before anything is resolved, using the same check already applied to remote reads. Paths that resolve to a network location, including obfuscated spellings of one, are refused, as are paths containing invisible characters. The offending path is never repeated back in the response.

Details
  • Rejections come back with the reason unsafe_path.
  • The user-facing text is "The target is a network path or an obfuscated spelling, which cannot be set as the working directory from a remote host. The path is deliberately not echoed back."
  • The existing rejection of paths containing invisible characters is unchanged and also withholds the path.
  • Applies unconditionally on the remote set-working-directory path; there is no setting that turns it off.
Evidence

The target is a network path or an obfuscated spelling, which cannot be set as the working directory from a remote host. The path is deliberately not echoed back., The target resolved to a network path or an obfuscated spelling, which cannot be set as the working directory from a remote host.

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.238 →