Claude Code 2.1.309: Trust Checks for Ultrareview

Lachlan Reed

Quick heads up before your nightly pipeline bites you. This is The Claude Code Changelog, brought to you by Jellypod AI. I'm Lachlan, and with me is James.

James Turner

Thanks, Lachlan. Today is one change from Claude Code 2.1.309, which shipped on October 22nd. The claude ultrareview command now requires workspace trust. In a terminal, it asks you to confirm. Anywhere else, it refuses to run. If you've got ultrareview in a script or a CI job, it will fail after you update, until you change it.

Lachlan Reed

Let's cover why it's built that way. Ultrareview isn't the local code review. It's a deep review that runs as a cloud session on Anthropic's infrastructure, with a fleet of reviewer agents going over your branch or pull request. So your repo state leaves your machine and gets worked on in the cloud. The reasoning in the brief is that if the workspace is untrusted, say a cloned open source repo or an unvetted PR, then config files or prompt injection payloads in that code could mess with the review. That part is interpretation of the design, not something the release notes spell out. What the notes do say is plain: it asks on a terminal, otherwise it refuses.

James Turner

So here's how you actually deal with it. Interactive use is easy. Run claude ultrareview, or the ultrareview slash command inside a session, and answer the trust prompt. Done. The scripting side is where the detail is. You pass the trust workspace flag, which is spelled with two hyphens, trust, hyphen, workspace. And this flag takes no value. That matters, because ultrareview also takes a PR number or a base branch.

Lachlan Reed

Yeah, and the changelog is explicit about this: put the PR number or base branch BEFORE the flag. So you'd write claude ultrareview, then 1234, then the trust workspace flag. Or claude ultrareview develop, then the flag. If you want findings posted straight to the pull request, it's claude ultrareview 1234, then the post flag, then the trust flag at the end. If you stick the flag first, you risk the parser treating your PR number as something it shouldn't, and that's a rubbish way to burn a CI run.

James Turner

There's also a second route. Set the environment variable CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK to 1. That's handy if you've got a dozen scripts and you don't want to edit every command line. Put it in your runner config once. Same effect, no per command flag.

Lachlan Reed

Now the caveats. First, that env var is a blunt tool. Setting it globally on a public repo workflow, especially one that runs on pull requests from forks, means you're switching off the check for code you don't control. The advice is to keep trust flags for internal branches and repos you've vetted. Second, billing and access. Ultrareview needs claude.ai authentication, so it's not available on Bedrock or Vertex setups, or with Zero Data Retention or HIPAA configurations. The brief says Pro and Max users get three free one time runs, then it uses usage credits, roughly five to twenty five dollars depending on diff size. Worth knowing before you wire it into a nightly job.

James Turner

Good point. Now a few smaller things from the same release. In bypass permissions mode in the Desktop app and VS Code, a dangerous rm or rmdir used to throw a prompt, and an unattended session would sit waiting. Now the command is denied straight away with a rewrite hint, so the agent can adjust and keep going.

Lachlan Reed

One to watch for on the sed side. Sed with the i flag, the in place edit, now gets the standard Bash prompt and runs exactly as written, instead of that simulated file edit preview. The catch is that, like other Bash edits, it's no longer restored by slash rewind. So if you lean on rewind as your safety net, commit before you let it loose.

James Turner

Two more. A nested CLAUDE.md over the size limit now loads only its start, which fixes sessions that kept compacting over and over after reading a huge one. And there's a security fix: on macOS and Linux, sandboxed Bash commands were running the shell's startup files outside the sandbox before each command. That's fixed.

Lachlan Reed

Last one's for VS Code folks. The wait for new problems after each Edit and Write in the chat panel is now 0.75 seconds in most cases, down from a second to a second and a half. Small, but you'll feel it. So grep your pipelines for ultrareview today, and fix the flag order while you're in there.