Unclear It is unclear whether a launch deny or ask rule starting with ! is now ignored or acts as an exception to the rules listed before it, and whether that part is also switched on remotely.
Claude Code can act as an MCP server, a tool host that other programs connect to and use. When it asks you to approve a command, it now records which folder the approval was given in, along with a fingerprint of that folder. A later request to run the command can then be sent back to that approved folder, but only if the folder still matches its fingerprint. A run can also be refused with the reason ask_changed.
The folder part is off unless it is switched on remotely.
There is also a new rule filter. Deny and ask rules given when Claude Code is launched that start with ! are now handled differently from other rules.
It closes a gap where the working folder could change between the moment you approved a command and the moment it ran, so the command could run somewhere you did not approve.
tengu_quizzical_locket Off in both readingsThe flag server returned off for the account this site reads and for the anonymous baseline. A reading of off cannot rule out a rollout these two readings sit outside of.
This account: off · anonymous baseline: off · compiled default in v2.1.323: off
These values were read against a different version of Claude Code, so treat them as the nearest reading available instead of one taken on this release.
Read once, for one account on one subscription tier, against v2.1.323. It isn't a statement about your account. What a flag value here can and cannot tell you
It is unclear whether a launch deny or ask rule starting with `!` is now ignored or acts as an exception to the rules listed before it, and…
New in this build: tengu_quizzical_locket