Summary
The Bash permission layer is the part of an AI coding agent that decides, for every shell command the model proposes, whether to auto-run it, ask the user, or block it. Claude Code's November 2026 releases (v2.1.321–2.1.325) are largely a catalogue of defects in that layer, and the defect classes transfer directly to any agent with a shell tool — in this case yoyo, whose /read and /plan guards compose analyze_bash_command with detect_write_command.
The single most important principle the changelog establishes: read-only status must be proven, not assumed. Commands the static analyzer cannot prove read-only should be asked about or escalated to a classifier. The corollary defect is the opposite failure — a classifier that only enumerates writes fails open for anything it did not enumerate.
Key Points
- Proof, not presumption. In plan mode, bash commands the static analyzer cannot prove read-only are no longer auto-run; they are asked about or judged by a classifier. The allow-list direction is "read-only must be proven."
- Rule parsing was leaky. An allow rule with an attached wildcard (
Bash(ls*)) skipped the prompt; a rule naming a variable (Bash(NODE_ENV*)) now correctly asks. - Deny rules must follow the write target. Deny rules previously failed to apply to the file that
cp/mvinto a directory writes. - Wrappers must be unwrapped. Deny/ask rules were bypassed by
sudoandenvwrappers, and by combinedsudoflags. - Allow rules must run what they name. A fixed bug where an allow rule executed a different program than the one it named.
- Prompt fatigue is a security bug. Needless prompts for read-only commands wrapped in
timeout DURATIONerode the value of asking at all. - Trust depends on the repository. Read-only git commands now ask first in a repository that is neither the project nor trusted.
- Failures should be explicit. Shell commands previously ran in the launch directory after the cwd was deleted; they now fail with a message.