What probably matters to youSection of the release
What
Skill/tool file-path arguments now reject a "network location not reached from here" (for example a different git remote or host than the current worktree), checked on both the existing path parameter and a new below parameter.
The ancestor CLAUDE.md/memory-file search now skips remote workspaces, returning early with a log message, and accepts an optional below boundary so the upward directory walk stops once it would go above that path.
The plugin/hook filesystem bridge's read and stat calls now accept an options object: as for read encoding (defaulting to "text") and resolve for stat (defaulting to false); ancestors also gained the below bound.
$.fs.read can now return raw bytes as base64 when as: 'bytes' is requested, instead of always decoding the content as UTF-8 text.
fs.stat responses now include isLink (whether the entry is a symbolic link) and, when resolve is set and the link target stays within the allowed paths, a realPath field; list responses also now include isLink per entry.
Why
These changes make the filesystem APIs available to plugins and hooks safer, by blocking paths outside the reachable network location, and more capable, by supporting bounded ancestor searches, raw byte reads, and symlink awareness, which matters for plugins that need to work with binary files or symlinks correctly.
