release aidev SIG 4/5

Claude Code 2.1.221: zsh permission bypass fixed, sandbox credential masking

Fixes a Bash permission-check bypass where zsh could execute hidden commands inside [[ ]] regex conditionals, plus a Windows PowerShell path-quoting mishandling in permission checks. Adds credential masking for sandboxed commands on Linux/WSL and changes /fork to create its own worktree.

PUBLISHED2026-08-03
OBSERVED2026-08-11
AGE8d
SOURCES1
  • Fixed a Bash tool permission-check bypass where zsh could execute hidden commands in [[ ]] regex conditionals; affected commands now prompt
  • Fixed PowerShell permission checks mishandling paths containing quote characters on Windows; such paths now prompt for approval
  • Added mode: "mask" for sandbox credential files on Linux and WSL — sandboxed commands read a sentinel copy while the sandbox proxy substitutes the real value on egress; on macOS file masking falls back to deny
  • Sessions forked with /fork now create a new worktree of their own instead of working in the original session's checkout
  • Plugins installed from /plugin now activate immediately when safe, instead of always requiring /reload-plugins; /plugin install refreshes a stale marketplace catalog and retries
  • Plugins accept "." as a skills path; claude plugin validate warns on names Claude Desktop's managed marketplace sync would reject
  • Background sessions now commit and push to preserve work, open a draft PR only when the task calls for one, and report where the work lives
  • Fixed MCP servers from --mcp-config not connecting before the first turn in print mode (-p), which made the model emit tool calls as literal text
  • Fixed CLAUDE_CODE_RESUME_INTERRUPTED_TURN=0 not disabling interrupted-turn auto-resume
  • Fixed WebSearch failing with a 400 at effort xhigh/max when thinking is disabled
  • Re-enabled tool search on Google Vertex AI for Claude 4.5-generation and newer models
  • Reduced prompt-cache costs for auto-mode permission checks by reusing the cached conversation prefix
  • /status now shows session kind: interactive, or a background job that is attached or unattended
  • [VSCode] Added Focus view (Ctrl+Alt+F) hiding tool activity behind an expandable per-turn summary
securityfixfeature

COMMUNITY

No curated reactions recorded for this event. Facts and takes are kept in separate layers — community context is added by hand, never blended into the record above.