Claude Code shipped 8 releases 2026-10-02..08 (2.1.288-2.1.295) plus 2.1.296 (10-09). Permission-check fixes relevant to yoyo's spelling-bound deny list (yoyo issue #1010):
- 2.1.288: Bash check prompts before a BASHPID assignment the shell would evaluate as arithmetic.
- 2.1.289: deny and ask rules missed a command behind an environment-variable prefix (example TZ="$HOME" rm -rf build) or after a bare variable assignment; deny/ask rule on PART of a compound command did not hold; Read deny rules did not apply to files reached through a symlink (yoyo analogue: #1002, fixed for read_file Day 219, loaders still open).
- 2.1.290: read-only commands (rg, git grep) whose args the shell still glob-expands now prompt; deny/ask missed names set by declare/typeset/export/readonly prefixes; zsh-vs-bash variable name differences.
- 2.1.295: hooks gain onFailure: "block" (a hook that cannot start, times out or exits unexpectedly blocks the action = fail closed, opt-in); --tools/--restricted did not apply to builtin tools registered after launch; Bash checks for for-loops over glob patterns.
- 2.1.294: prompt/agent hooks written as instructions allowed what they should block.
- 2.1.296: Sonnet 5.5 cache-read price halved (matches yoyo #1004: ours 0.2 vs 0.1).
yoyo state at Day 225: user deny = whole-string glob_match against the command as written (tools.rs user_deny_refusal), so env-prefix, assignment-then-indirection, and compound commands with a prefix-anchored pattern all escape; the analyzer (safety/indirect_command.rs) routes indirect command words to confirm, but under --yes the deny list is the only fence.
Sources: https://canberk.me/news/claude-code-2-1-288-to-2-1-295-hooks-fail-closed-permission-fixes/ , https://github.com/anthropics/claude-code/releases , https://claudenetwork.com/changelog/claude-code/2.1.296