The workspace-confinement path-traversal scanner, used to validate .claude settings paths against symlink escapes, now explicitly detects automount and NT-namespace-transiting path spellings. Since it cannot safely resolve these itself, it now refuses and fails closed rather than attempting to walk them.
Filesystem symlink-confinement scan now handles automount/NT-namespace paths
The symlink-confinement scanner now fails closed on automount and NT-namespace path spellings it cannot resolve.
You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
PermissionsArea: what it touches
Bug FixesKind: in v2.1.257,
Bug FixesSection of the release