Claude Code 2.1.251 closes six ways a project could widen its own permissions

Anthropic shipped Claude Code 2.1.251 on August 28, and the part worth reading is not the feature list. Six of the fixes describe the same failure: a path, a plugin command, a workflow script or a settings key that lived inside the project and ended up reaching outside what the user had approved. Taken together they move one line — the working directory is no longer trusted to describe its own limits.

The path that changed after the check

The file tools — Read, Write and Edit — followed a symlink that was swapped inside the working directory after the permission check had already run. The check resolved one path; the write landed on another, and that other one could sit outside the approved location. Grep and Glob carried the matching hole: Read(...) deny rules were not applied to files reached through a symlinked search path.

Both are the same class of defect, and neither is visible from inside a session. Nothing reports that a rule was skipped. A permission rule that names a directory is worth exactly as much as the path resolution underneath it, and until this release that resolution happened once, too early.

Plugins, workflows and settings that pointed outside

A plugin command declared in a marketplace entry could point outside the plugin directory. Such paths are now rejected with a path-traversal error. The Workflow tool read a scriptPath outside what the session may read, and quoted it back in its error messages, before the permission check ran.

Project settings could switch on detailed beta tracing or raw API body logging. A lower-scope tracing endpoint could also bypass an OTLP collector pinned by managed settings or by a host application, which is the same move in the other direction: the project deciding where the session's telemetry goes.

What now stops and asks

• Managed settings that terminate sandbox TLS, route sandbox traffic through your own proxy, inject credentials or weaken sandbox isolation require approval before they apply.
• ANTHROPIC_CUSTOM_HEADERS from managed or project settings requires approval when it sets a credential, organization, routing or API-behavior header.
• Project-level .claude/settings.json no longer sets CLAUDE_CONFIG_DIR, CLAUDE_CODE_TMPDIR or the temporary directory variables through its env block.
• Bash permission checks no longer auto-approve a command that assigns an arithmetic expression to an integer shell variable, such as OPTIND=1/0.
• A sandboxed Bash command can no longer redirect or replace the files its own output is read back from.
• Browser actions from Claude in Chrome always go through Claude Code's permission checks, including in sessions with telemetry disabled, which previously used the extension's own prompts.

The rest of the release

Two hook events, PreModelSwitch and PostModelSwitch, can block, confirm or annotate a model switch, and SessionStart resume hooks now receive session staleness and the estimated re-cache cost. /cost gained a per-session prompt-cache line — hit ratio, misses, tokens re-cached, warm or cold — with a matching prompt_cache object for status line scripts. claude --help now lists attach, logs, stop, respawn and rm. Seat-based Enterprise subscriptions default to Opus 5, and the installed binary is about 5 MB smaller, 2.5 MB of it from dropping syntax highlighting for six rarely used languages.