Claude Code v2.1.228 Fixes a Cross-Session Security Hole
This episode breaks down a security fix in Claude Code v2.1.228 that holds cross-session messages for approval before they can reach elevated terminals. It also covers the new dialogExpiry setting for headless workflows, plus quality-of-life updates to Write tool behavior and sandboxing for synced skills.
Show Notes
- claude-code/CHANGELOG.md at main: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md
Chapter 1
Securing Cross Session Messaging in Claude Code v2.1.228
Lachlan Reed
This episode is brought to you by Jellypod AI. So, James, mate, if, if you are running multi terminal setups with Claude Code, there was a pretty sneaky security hole in how inter session messaging worked.
James Turner
Oh, absolute nightmare scenario! If you had a background agent session using SendMessage, it could actually pass prompts directly into another terminal running with bypassed permissions, and, uh, execute arbitrary shell commands right on your machine.
Lachlan Reed
Far out. So if an unvetted background agent goes rogue, it could basically take over the second session. But version 2.1.228 fixes this, right?
James Turner
Exactly. The huge headline update is that cross session messages sent to a session running with bypassed permissions are held for your approval. You get explicit control before anything touches that elevated session.
Lachlan Reed
Nice! So, uh, how do we actually configure this in our setup? Is it in the settings file?
James Turner
Yeah, it is all managed inside your .claude/settings.json file, either locally or globally. They introduced two specific settings: crossSessionInbound and dialogExpiry.
Lachlan Reed
Right, right. So you set "crossSessionInbound" to, uh, "hold" so those messages do not just slip through automatically?
James Turner
Spot on. You set "crossSessionInbound": "hold", and then you pair it with "dialogExpiry". You can set dialogExpiry to a number like 300, or a string like "5m" for five minutes.
Lachlan Reed
Wait, let me guess why that expiry part is so crucial. If you are running unattended sessions, like in automated CI CD pipelines or self hosted runners... if a prompt gets held and there is no human around to click approve...
James Turner
It just hangs! Without dialogExpiry, headless build pipelines would freeze indefinitely waiting for approval that is never coming. With the timeout, it safely fails or aborts after those five minutes.
Lachlan Reed
Man, I have definitely had builds hang overnight because of a missing prompt timeout before. That is a life saver.
James Turner
Totally. And speaking of version 2.1.228, there are two other really nice quality of life upgrades in this release that are worth calling out.
Lachlan Reed
Oh yeah? What else did they tweak?
James Turner
First, the Write tool rules got updated. Newer Claude models no longer need to make a mandatory Read tool call before overwriting an existing file. If the model wants to overwrite, it can just write straight away.
Lachlan Reed
Oh, beautiful! That extra read step used to burn unnecessary tokens and slow down file updates. What was the second thing?
James Turner
Sandboxing for synced skills! Any skills synced from claude.ai are now sandboxed so they cannot execute exclamation point shell commands, and they cannot use at symbol file path expansions.
Lachlan Reed
Ah, locking down those shell escapes and file path expansions keeps third party skills strictly in their lane. Proper security boundary there.
James Turner
Exactly. Securing inter session prompts and sandboxing skills in one tight release. Pretty solid update all around.
Lachlan Reed
Alright, go update your settings files, folks. Catch you next time!