You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
3Signal: worth watching, 1 to 5
PermissionsArea: what it touches
ImprovementsKind: in v2.1.248,
ImprovementsSection of the release
What
The path checks that decide whether a command touches something you have not permitted now normalise away /./ and doubled slashes before matching, and reject paths under /proc/self, /proc/thread-self, numbered /proc/<pid> directories and /dev/fd, /dev/stdin, /dev/stdout, /dev/stderr. Git flags that redirect where a repo lives get special treatment. Active in this build with no flag to set.
Details
Flags handled specially include --git-dir, --work-tree, --namespace, --attr-source and --shallow-file, plus environment variables such as GIT_INDEX_FILE.
These were all ways to name a file the permission check would not recognise as the file actually being read or written.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeFixed claude remote-control rejecting its own flags (e.g. --spawn, --name) when a global flag or a wrapper-injected option precedes the…
