Claude Code permission rules did not refuse what they described, and the fix missed the channel most people run
v2.1.214 repairs a batch of permission checks that failed open: an Edit(src/**) rule auto-approving a nested directory anywhere in the tree, a Windows PowerShell 5.1 bypass, Bash file-descriptor redirect forms, commands over ten thousand characters running unprompted, zsh subscripts treated as inert, and help and man auto-approving. At window close the stable channel still served 2.1.212 while latest served 2.1.220.
What this changes for operators
- Move to the latest channel or pin minimumVersion to 2.1.214, then re-test any rule you rely on by writing a deny and confirming the action is actually refused. An operator who wrote Edit(src/**) believed they had scoped write access to one directory and did not have it.
Featured in
- Assume the Rule Does Not Bind / 2026-07-27
Run: 2026-07-27-weekly-digest-2026-07-02_2026-07-27-frontier-v0
Schema: bitter.frontier_signals.v0 / ID: 2026-07-27-claude-code-permission-rules-did-not-refuse
Research evidence and publication history are open in the repository.