You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
WorkflowsArea: what it touches
New FeaturesKind: in v2.1.251,
New FeaturesSection of the release
What
If a workflow's script file sits outside the set of paths the session is allowed to read, the tool now denies the call outright instead of quietly carrying on.
Details
The denial happens in the workflow tool's permission check, so it is reported as a permission failure rather than a missing file.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeFixed the Workflow tool reading (and quoting in errors) a scriptPath outside what the session may read before the permission check ran
