What
RSYNC_CONNECT_PROG is an environment variable read by rsync, a file-copying program. rsync runs the variable's value through the shell. This release adds two checks for that name in commands Claude Code runs:
- The guard that keeps git commands inside an isolated worktree now rejects any command that names
RSYNC_CONNECT_PROG, even when the name is only mentioned. The match ignores letter case and still works when the name is split by quotes,$expansions, backticks, backslashes or brace lists. A worktree is a separate working copy of a git repository. The stated reason is that rsync runs the value through the shell, so the guard cannot show that what it runs is not git. - A separate scan of Bash commands looks for the same name. It first removes quotes and backslash-newlines and converts everything to capital letters. It then allows the characters
$,`,{,,,}and\between the letters. A match is only recorded and appears not to block the command.
Why
The name can be written in ways that hide it from a simple search, and setting it makes rsync run another program. If you run Claude Code in an isolated worktree and your commands use rsync with a connection program, they will now be blocked there.