Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.246 Home All releases ←olderv2.1.245 v2.1.247newer→
Claude Code v2.1.246

Hook and MCP program trust checks look at a second PATH

Under the hood
Useful2 Signal3
Hooks

Hook and MCP programs are checked against two PATHs, and any mismatch counts as risky.

What

The check deciding whether a hook command or MCP stdio program is unreadable or in reach now resolves the program against both the base environment PATH and a separate MCP-specific path, and treats any disagreement between the two as in reach. Interpreted programs are probed as well.

Details
  • The shell prefix used to expand a hook command now comes from the calling context instead of being read from CLAUDE_CODE_SHELL_PREFIX in the environment.
  • The old launch-directory reach builder and its HostPathRefused error were removed, replaced by a routine that decides which settings scopes are in reach and treats a file with more than one hard link as reachable.
Evidence

program_in_reach

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.246 →