Under the hoodTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
PermissionsArea: what it touches
Internal ChangesKind: in v2.1.265,
Internal ChangesSection of the release
What
Claude Code blocks bash commands that use heredocs (multi-line input blocks) or pipes to read files outside your working directories. That check now also looks at the command's "always deny" rules, checking whether any of them target the current session and whether none of the other deny rules (aside from a host-credential rule) apply, before deciding whether to block the read.
Why
This tightens the existing protection against commands that try to read sensitive files (like host credentials) from outside the working directory, making the block more consistent with how always-deny rules are otherwise enforced.
