release aidev SIG 3/5

Claude Code 2.1.210: worktree isolation escape fixed, ultracode opt-in restricted to human input

Fixes an isolation hole where isolation: 'worktree' subagents could run git-mutating commands against the main checkout, and stops the ultracode keyword from triggering on webhook payloads and relayed PR comments. Adds a startup warning for Write(path)/NotebookEdit(path)/Glob(path) permission rules.

PUBLISHED2026-07-14
OBSERVED2026-08-11
AGE28d
SOURCES1
  • Fixed isolation: 'worktree' subagents mutating git in the main repo checkout instead of their own worktree
  • Fixed the ultracode keyword opt-in firing on non-human input (webhook payloads, relayed PR comments)
  • Hardened the Agent tool against indirect prompt injection via content a subagent read
  • Startup warning for Write(path), NotebookEdit(path), Glob(path) permission rules — use Edit(path) or Read(path)
  • Live elapsed-time counter on collapsed tool summary lines
  • Fixed a hook callback timeout being reported to the model as a user rejection, which stalled unattended sessions
  • Fixed Claude assuming a cd took effect after its command was backgrounded; the result now states the directory is unchanged
  • Fixed plugin-provided MCP servers torn down on mid-session MCP re-sync
  • Fixed plan approvals with no edits labeled "(edited by user)" and overwriting the plan file with a stale snapshot
  • Fixed claude agents --effort ultracode being silently dropped, and claude attach "job not found" errors during session transitions
  • Fixed killed background sessions leaving a permanent git worktree lock
  • Fixed unmatched $1/$2 placeholders in skills and commands being silently stripped
  • Auto mode's permission classifier defaults to Sonnet 5 for external sessions, pinned for the session
  • Memory writes leaving MEMORY.md over its read limit now error instead of truncating silently
  • Fable temporarily marked unavailable in the advisor picker pending a server-side fix
fixsecurityfeature

COMMUNITY

No curated reactions recorded for this event. Facts and takes are kept in separate layers — community context is added by hand, never blended into the record above.