You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
WorkflowsArea: what it touches
New FeaturesKind: in v2.1.251,
New FeaturesSection of the release
What
A workflow script path is now refused unless it is a path the tool itself returned or a file you can already read, meaning one under the working directory or an added directory. The refusal states the rule explicitly instead of the path being used silently.
Details
Applies unconditionally, with no flag to relax it.
Evidence
scriptPath must be a script path this tool returned, or a file you can already read
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeFixed the Workflow tool reading (and quoting in errors) a scriptPath outside what the session may read before the permission check ran
