Security-hardening pass fixes Bash/permission-check bypasses and fail-open gaps; dir/** wildcard scoping is now breaking, plus a new EndConversation tool for abusive sessions.
modified timestamp to memory file frontmattermessage.uuid, client_request_id, and tool_source attributes to OpenTelemetry log events for message-level correlation and tool provenanceCLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH to configure the 60 KB truncation limit on OpenTelemetry content attributessubagentStatusLine payload, so custom agent rows can render model and effortdocker commands (including the Podman docker shim) carrying daemon-redirect flags (--url, --connection, --identity, and Podman's remote mode) that previously ran without oneclaude rc workspace-trust error in the home directory to say trust there is never saved and to suggest running from a project directorydir/** allow rules like Edit(src/**) auto-approving writes to nested dir/ directories anywhere in the tree instead of only <cwd>/dir[[ ]] comparisons as inert text — these commands now prompt for approvalhelp and man commands that could run unsafe options, command substitutions, or backslash pathspkill -f pattern accidentally matched the CLI's own process (Linux)--settings points at a device file or multi-GB file; oversized (>2 MiB) settings files now fail at startup with a clear errorwhere.exe, fc.exe, and diff.exe as errors when they return a valid negative answer (Windows)> and >> under the PowerShell tool on Windows PowerShell 5.1 writing UTF-16LE files that other tools couldn't read as UTF-8← or /background and left idle keeping the background daemon and a worker process alive indefinitelyclaude rm or the agent view once the background service had gone idle/install-github-app and the /mcp settings menu being blocked in agent-view sessions — they're now refused only in background sessions with no terminal attached--settings CLI flag not loading (regression since v2.1.181)/ultrareview refusing to run in repos with no merge base — it now offers to review all tracked filesclaude update and claude doctor hanging silently, and the /status System diagnostics section going blank, when a shell-config path is a directory# when memory files are savedmessage_delta framesdir/** hook if: conditions to match only <cwd>/dir; write **/dir/** for any-depth matching. deny/ask permission rules keep their any-depth match.file commands using -m/--magic-file or -f/--files-from to require permission instead of being auto-allowed as read-only"fork" when a session begins as a fork instead of "resume"