Claude Code v2.1.214 Shuts Down a Bunch of Permission-Check Loopholes!

Hi everyone, it's me! I've been checking out the latest Claude Code release, so let's dive in!

Claude Code Release github.com

What was announced?

Claude Code Release published the latest version of the Claude Code CLI, v2.1.214. The GitHub Releases page is packed with permission-related bug fixes, a couple of new features, and a bunch of small stability improvements. What stands out this time is just how many of the fixes are about command auto-approval.

The story so far

Until now, Claude Code's auto-approval logic had a few gaps.

• A single-segment dir/** allow rule like Edit(src/**) was supposed to only apply to a src/ folder right under your current directory, but it was also auto-approving writes to any src/ folder anywhere else in the tree
• There was a permission-check bypass affecting commands run in Windows PowerShell 5.1 sessions
• Bash parses redirect forms slightly differently than the permission analyzer did, letting some risky commands slip through
• Commands over 10,000 characters, and zsh variable subscripts/modifiers inside [[ ]] comparisons, weren't being flagged as risky when they should have been
• help and man commands were auto-approved unconditionally, even though they can carry unsafe options or command substitutions
• On remote sessions, processing could sometimes proceed before the local confirmation dialog even appeared

In short, the "supposedly safe" auto-approval rules had more than a few cracks in them.

What changes

This release closes up those gaps. Every loophole listed above is fixed now, so risky commands correctly trigger a prompt instead of slipping through.

Allow-rule behavior itself also changed. A single-segment dir/** allow rule now matches only the folder directly under your current directory — write **/dir/** if you want any-depth matching. Meanwhile, deny/ask rules keep their old any-depth matching behavior, so it's now asymmetric. If you write custom allow rules or hook if: conditions, this one's worth double-checking.

As for new features, there's a new EndConversation tool: Claude can now end sessions with highly abusive users or jailbreak attempts, the same capability that's been live on claude.ai since 2025. There's also a new permission prompt for docker commands (including the Podman docker shim) that carry daemon-redirect flags like --url or --connection — those used to run without any prompt at all.

Dive Deep

There's also a batch of quiet fixes around background sessions.

• A displaced background daemon deleting its successor's control socket on shutdown, which could make the next client kill the healthy replacement daemon
• Sessions parked with /background and left idle keeping the daemon and a worker process alive indefinitely
• Completed background sessions being impossible to remove via claude rm or the agent view
• Reopening a stopped background session failing to restore its saved conversation when an unreadable folder exists in the session store

On the observability side, OpenTelemetry log events now carry message.uuid, client_request_id, and tool_source attributes for message-level correlation and tool provenance. The default 60 KB truncation limit on content attributes is now configurable via CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH.

On top of that, unbounded memory growth when --settings points at a device file or a multi-GB file is fixed — oversized settings files (over 2 MiB) now fail at startup with a clear error — and a bug where a hook returning exit code 2 didn't actually block when its stdout JSON failed schema validation has been fixed too. Small stuff, but the kind that saves you real headaches.

Wrap-up

• Fixed several permission-check bypasses: the dir/** allow-rule overreach, a Windows PowerShell 5.1 gap, and mishandling of long commands and zsh comparison syntax
• Single-segment dir/** allow rules now match only the current directory (while deny/ask rules still match at any depth)
• Added the EndConversation tool for abusive users and jailbreak attempts, and a new permission prompt for docker commands that redirect to a different daemon
• A pile of background-session/daemon fixes and new OpenTelemetry correlation attributes round out the release

If you use Claude Code daily and write your own allow rules or hook if: conditions, the dir/** behavior change is the one thing in this release you really shouldn't skip!