Evidence record / claude-code
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the signals and issues that cite it, below.
2026-09-21-claude-code-2-1-257-authority-batch-project-bypass-ignored-ask-rules-skipped-in-auto
2.1.257 (2026-09-01) makes defaultMode bypassPermissions in project or local settings files take no effect, as auto already did, so a repository can no longer put a clone into bypass mode. It adds an auto-mode rule that stops auto-approving cloud metadata-credential fetches, egress evasion and cross-tenant reach, and a one-time prompt before the first read outside the working directories with permissions.blockReadsOutsideWorkingDirectories. It fixes a permissions.ask rule being skipped in auto mode when the command ran inside a compound command or subshell; Bash Read() and Edit() deny rules not applying to < file redirects or reader commands such as tac and egrep; and dismissing the Remote Control consent prompt with Esc or n counting as consent. Same release makes Claude Fable 5.1 the default Fable model.
Channel: tagged-release (2.1.257; on stable 2.1.267). Half: both.
Operator consequence: Any repo that committed bypassPermissions loses it on upgrade. Any auto-mode policy that treated permissions.ask as the human checkpoint did not hold for a && b or $(…) forms before 2.1.257; re-test with a compound command. Check the claude.ai session list on any Remote Control host where the consent prompt was dismissed on an older build.
Receipt
Finding metadata
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
Finding ID: 2026-09-21-claude-code-2-1-257-authority-batch-project-bypass-ignored-ask-rules-skipped-in-auto
Accepted signals
Profile citations
- Claude Code / claim / project-bypass-ignored
Source links
Primary links, including exact changelog lines when available.
Versioned source: run artifact