You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
PermissionsArea: what it touches
ImprovementsKind: in v2.1.259,
ImprovementsSection of the release
Path-restriction deny rules now reach further into command arguments: file-like arguments are extracted from -e/-f/--file flags, key=value pairs, @file tokens, colon-separated tokens, and combined short flags, and denied if the resolved path matches a Read() deny rule. Separately, grep, egrep, fgrep, rg, diff, git, cp, and mv get this same path check, falling back to an 'ask' prompt when the path can't be resolved after a cd.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeFixed Bash Read() deny rules not covering files given as option values (--ignore-revs-file=.env, -f.env, @file), git diff/git grep file…
