You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
SandboxArea: what it touches
ImprovementsKind: in v2.1.259,
ImprovementsSection of the release
The sandboxed git command allowlist now parses -C, --work-tree, and --work-tree= flags before the subcommand and resolves relative paths against that worktree. It also adds a full handler for git grep, alongside the existing expanded handling for git diff. This applies to everyone using the restricted git wrapper.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeFixed Bash Read() deny rules not covering files given as option values (--ignore-revs-file=.env, -f.env, @file), git diff/git grep file…
