You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
PermissionsArea: what it touches
ImprovementsKind: in v2.1.268,
ImprovementsSection of the release
What
When a permission rule is written against a file path that turns out to be a symlink, Claude Code now also resolves that path to its real, canonical location on disk, and adds an equivalent rule for that resolved "physical twin" path. This applies to deny rules during permission-rule compilation.
Why
Without this, a deny rule written against a symlinked path could be bypassed simply by accessing the same file through its real, resolved path instead of the symlink. Now both paths are covered by the same rule.
