Claude Code now warns about the permission rule that looks narrow and is not
Version 2.1.246 adds a startup warning for Bash allow rules that put a wildcard before the subcommand, such as Bash(git * main). It also puts auto mode's classifier rules into the permissions screen where they can be read and edited.
A permission rule is a promise you make to yourself about what a tool may do without asking. Claude Code 2.1.246, released on August 25, adds a warning at startup for a shape of rule that quietly breaks that promise: an allow rule for Bash with a wildcard sitting before the subcommand.
Why the wildcard position matters
Written as Bash(git * main), the rule reads like permission for one narrow thing. The wildcard sits where the subcommand goes, and the release notes are specific about what that means: such a rule also matches when options are inserted ahead of the subcommand. The distance between what the rule looks like and what it grants is the entire problem, and until now nothing pointed it out.
The warning fires at startup rather than at the moment the command runs, which is the right time for it: a permission list is written once and then trusted for weeks.
Auto mode's rules stop being invisible
The same release adds an Auto mode tab to the permissions screen, for viewing and editing the classifier rules that decide what auto mode may do on its own. Rules that decide things on your behalf and cannot be read are difficult to trust; this makes them a list like any other.
The rest of the release is a long run of fixes rather than features, among them background sessions that failed to open, MCP tool arguments sent as JSON strings, and the Write tool reporting an out-of-memory error on large files.
Corrections
An earlier version explained that a rule of the form Bash(git * main) covers any git subcommand at all. After checking the primary source the explanation has been corrected: the release notes say such a rule also matches when options are inserted ahead of the subcommand, which is the reason the warning exists.
Related
OpenClaw 2026.10.2 stops long tool output from slipping credentials past redaction
A bug in OpenClaw's secret masking let a credential through whenever it straddled the boundary between two slices of a long text. The fix ships in 2026.10.2 along with repaired updates from 2026.10.1 and a new compaction default for OpenAI and Anthropic API keys.
OpenClawverified
OpenClaw 2026.10.1 lets agents search installed skills and changes how sessions message each other
OpenClaw released version 2026.10.1 on October 10, 2026, its first stable release since 2026.9.7. Agents can now search the skills installed on a machine and read only the one a task needs, instead of carrying the whole library in the prompt. Opt-in MCP Apps run beside chat, and full backups can go to an external drive or Cloudflare R2. Three changes can break existing setups: session-to-session messaging, the old required argument, and Workboard data stored before July 2026.
OpenClawverified
Claude Code 2.1.294 fixes prompt hooks that let through the actions they were written to block
Anthropic released Claude Code 2.1.294 on October 8, 2026. It fixes prompt and agent hooks phrased as instructions, which could allow exactly the actions they were meant to stop. Version 2.1.295 followed the same day with an onFailure setting that makes a crashed or timed-out command or HTTP hook block the action. Releases 2.1.292 and 2.1.293 from earlier in the week closed several permission and sandbox gaps.
Claude Code Releases (GitHub)verified