Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.248 Home All releases ←olderv2.1.247 v2.1.250newer→
Claude Code v2.1.248

Command inspection no longer fooled by /proc paths or git redirection flags

You'll notice
Useful3 Signal3
Permissions

Command path checks now reject /proc and /dev descriptor tricks and handle git redirection flags.

What

The path checks that decide whether a command touches something you have not permitted now normalise away /./ and doubled slashes before matching, and reject paths under /proc/self, /proc/thread-self, numbered /proc/<pid> directories and /dev/fd, /dev/stdin, /dev/stdout, /dev/stderr. Git flags that redirect where a repo lives get special treatment. Active in this build with no flag to set.

Details
  • Flags handled specially include --git-dir, --work-tree, --namespace, --attr-source and --shallow-file, plus environment variables such as GIT_INDEX_FILE.
  • These were all ways to name a file the permission check would not recognise as the file actually being read or written.
Evidence

/(^|[\\/])proc[\\/](self|thread-self|\d+)([\\/]|$)/i

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.248 →