# Claude Code v2.1.214 Shuts Down a Bunch of Permission-Check Loopholes!

Hi everyone, it's me! I've been checking out the latest Claude Code release, so let's dive in!

## What was announced?

Claude Code Release published the latest version of the Claude Code CLI, v2.1.214. The GitHub Releases page is packed with permission-related bug fixes, a couple of new features, and a bunch of small stability improvements. What stands out this time is just how many of the fixes are about command auto-approval.

## The story so far

Until now, Claude Code's auto-approval logic had a few gaps.

- A single-segment `dir/**` allow rule like `Edit(src/**)` was supposed to only apply to a `src/` folder right under your current directory, but it was also auto-approving writes to any `src/` folder anywhere else in the tree
- There was a permission-check bypass affecting commands run in Windows PowerShell 5.1 sessions
- Bash parses redirect forms slightly differently than the permission analyzer did, letting some risky commands slip through
- Commands over 10,000 characters, and zsh variable subscripts/modifiers inside `[[ ]]` comparisons, weren't being flagged as risky when they should have been
- `help` and `man` commands were auto-approved unconditionally, even though they can carry unsafe options or command substitutions
- On remote sessions, processing could sometimes proceed before the local confirmation dialog even appeared

In short, the "supposedly safe" auto-approval rules had more than a few cracks in them.

## What changes

This release closes up those gaps. Every loophole listed above is fixed now, so risky commands correctly trigger a prompt instead of slipping through.

Allow-rule behavior itself also changed. A single-segment `dir/**` allow rule now matches only the folder directly under your current directory — write `**/dir/**` if you want any-depth matching. Meanwhile, `deny`/`ask` rules keep their old any-depth matching behavior, so it's now asymmetric. If you write custom `allow` rules or hook `if:` conditions, this one's worth double-checking.

As for new features, there's a new EndConversation tool: Claude can now end sessions with highly abusive users or jailbreak attempts, the same capability that's been live on claude.ai since 2025. There's also a new permission prompt for `docker` commands (including the Podman `docker` shim) that carry daemon-redirect flags like `--url` or `--connection` — those used to run without any prompt at all.

## Dive Deep

There's also a batch of quiet fixes around background sessions.

- A displaced background daemon deleting its successor's control socket on shutdown, which could make the next client kill the healthy replacement daemon
- Sessions parked with `/background` and left idle keeping the daemon and a worker process alive indefinitely
- Completed background sessions being impossible to remove via `claude rm` or the agent view
- Reopening a stopped background session failing to restore its saved conversation when an unreadable folder exists in the session store

On the observability side, OpenTelemetry log events now carry `message.uuid`, `client_request_id`, and `tool_source` attributes for message-level correlation and tool provenance. The default 60 KB truncation limit on content attributes is now configurable via `CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH`.

On top of that, unbounded memory growth when `--settings` points at a device file or a multi-GB file is fixed — oversized settings files (over 2 MiB) now fail at startup with a clear error — and a bug where a hook returning exit code 2 didn't actually block when its stdout JSON failed schema validation has been fixed too. Small stuff, but the kind that saves you real headaches.

## Wrap-up

- Fixed several permission-check bypasses: the `dir/**` allow-rule overreach, a Windows PowerShell 5.1 gap, and mishandling of long commands and zsh comparison syntax
- Single-segment `dir/**` allow rules now match only the current directory (while `deny`/`ask` rules still match at any depth)
- Added the EndConversation tool for abusive users and jailbreak attempts, and a new permission prompt for `docker` commands that redirect to a different daemon
- A pile of background-session/daemon fixes and new OpenTelemetry correlation attributes round out the release

If you use Claude Code daily and write your own allow rules or hook `if:` conditions, the `dir/**` behavior change is the one thing in this release you really shouldn't skip!