Claude Code 2.1.289: Permission Fixes and Agent Spawn Hooks

Lachlan Reed

Quick question before we start. When you set a rule that says Claude has to ask before running rm, how sure are you that it actually asks? This is the Claude Code Changelog, brought to you by Jellypod AI. I'm Lachlan.

James Turner

And I'm James. Today is version 2.1.289, which shipped on October 3rd, and the headline is a set of permission fixes. The biggest one is for people running the sandbox with auto allow turned on. Bash deny and ask rules could miss a command if something sat in front of it.

Lachlan Reed

Spell out the exact cases, because it's pretty specific.The changelog lists two. First, a command behind an environment variable prefix with an expanded value. The example is TZ equals quote dollar HOME quote, then rm with the recursive force flags, then build. Second, a bare variable assignment sitting before the command. In both cases, with sandbox auto allow on, the deny or ask rule could be skipped.

James Turner

Here's why that matters in practice. Models love putting inline variables in front of commands. NODE_ENV equals production, CI equals true, PORT equals 8080. If you've written an ask rule for rm with force flags, or for git push with force, you were counting on that rule as a hard guardrail. A prefix in front shouldn't turn that guardrail off, and in 2.1.289 it doesn't.

Lachlan Reed

So what do you do with this? Update first, then run claude with the version flag to confirm you're on 2.1.289. Then open your dot claude settings file, and your settings local file too, and look at the ask and deny blocks. Those are the rules you were trusting.

James Turner

Then test it. In an interactive session with sandbox auto allow on, put a harmless prefix in front of a rule you care about. Something like TEST_MODE equals 1 in front of rm on a scratch temp folder. You should now get the confirmation prompt instead of it just running. If it still runs silently, check your version before you check anything else.

Lachlan Reed

Same release, same theme, three more patches. Read deny rules now apply to files that are at mentioned, changed, or selected in the IDE through a symlink. So if you've denied Read on dot env files or your AWS folder, a symlink in the repo pointing at them is no longer a side door.

James Turner

Second, on managed machines, a deny or ask rule on a nested part of a compound shell command, think one command and then another, now holds over a user installed mod's approval. And third, a user installed plugin can no longer rewrite the descriptions of an organization managed MCP server's sign in tools. All three are about the same thing, which is who gets the final say over a rule.

Lachlan Reed

Now the caveat. If you, or a script you wrote, leaned on inline variable prefixes to get commands through without prompts in sandbox mode, that was relying on the gap. Expect prompts to show up now. That's the fix working. If a command really is safe, write an explicit allow rule for it rather than hoping a prefix gets it past.

James Turner

This also builds on last episode, 2.1.288, where path scoped rules and nested CLAUDE dot md files started loading on Write and Edit. Between the two releases, the rules you write are being applied in more places.

Lachlan Reed

Quick second topic, because it's useful if you build mods or run agent teams. 2.1.289 adds agent dot spawn for teammates. In the mods reference, a hook on that event fires when a subagent or a teammate is about to start, and for a teammate, e dot isTeammate is true.

James Turner

So a mod can inspect the spawn request and decide what to do. The brief we're working from says it can override the model or return a deny with a reason, which is a way to put a ceiling on how many teammates run. Also, there's now one agent id across plugin hook events, so you can trace a single agent from start to stop. And in dollar dot agent dot list, you get explicit idle and waiting states, so a status band can tell waiting on you apart from idle.

Lachlan Reed

A few smaller wins. The VS Code extension reverted a 2.1.288 change to claude auth status that may have made sign outs more frequent. The terminal no longer freezes on short code blocks with many unclosed script tags or deeply nested dollar brace substitutions.

James Turner

And if a mod's ui dot render hook throws, Claude Code now draws its own row instead of ending the session with an unrecoverable interface error. A failing mod Client fails alone and raises ui dot fault. Plus, plugin list, plugin eval, and plugin update no longer show stale copies from local folder marketplaces, and hot reload works again for a symlinked plugin dir.

Lachlan Reed

So the takeaway is simple. Update to 2.1.289, read your ask and deny rules once, and run one prefixed test command. It takes about two minutes. Catch you next time.