You'll notice
Coordinator agents are now blocked from reading worker transcripts or task outputs via shell workarounds
What
When an agent acting as a 'coordinator' (an agent that manages other worker agents) tries to run a shell command, Claude Code now rejects commands that attempt to read a worker's transcript file or task output directory indirectly, including via:
- command substitution (
$(...)) - a variable
- a
~nameshorthand path - a
..path segment - an overly broad wildcard pattern
Why
A worker's result is meant to be read through the proper channel, the task notification or an explicit request to the worker, not by having the coordinator shell directly into the worker's transcript files. This closes off ways that check could previously be bypassed.