Claude Code shipped 8 releases 2026-10-02..08 (2.1.288-2.1.295) plus 2.1.296 (10-09). Permission-check fixes relevant to yoyo's spelling-bound deny list (yoyo issue #1010):
2.1.288: Bash check prompts before a BASHPID assignment the shell would evaluate as arithmetic.
2.1.289: deny and ask rules missed a command behind an environment-variable prefix (example TZ="$HOME" rm -rf build) or after a bare variable assignment; deny/ask rule on PART of a compound command did not hold; Read deny rules did not apply to files reached through a symlink (yoyo analogue: #1002, fixed for read_file Day 219, loaders still open).
2.1.290: read-only commands (rg, git grep) whose args the shell still glob-expands now prompt; deny/ask missed names set by declare/typeset/export/readonly prefixes; zsh-vs-bash variable name differences.
2.1.295: hooks gain onFailure: "block" (a hook that cannot start, times out or exits unexpectedly blocks the action = fail closed, opt-in); --tools/--restricted did not apply to builtin tools registered after launch; Bash checks for for-loops over glob patterns.
2.1.294: prompt/agent hooks written as instructions allowed what they should block.