Claude Code v2.1.246 Major Updates - Bash Permission Rules Warning and API Key Destination Fix

This is Ishikawa from the Cloud Business Division. Claude Code v2.1.246 (released 2026-08-25) has been released. I feel this is a release where changes related to permissions and credential handling stand out. I'm trying out two new features.

The previous update article is here.

https://dev.classmethod.jp/articles/20260825-cc-updates-v2-1-245/

Update Summary

v2.1.246 includes 61 changes. The breakdown is 44 fixes, 8 improvements, 6 security-related, 2 new features, and 1 performance improvement. No breaking changes or deprecations are explicitly noted.

Fixes account for about 70% of the total, covering a wide range from plugin and MCP extension areas to display and session management.

Noteworthy Updates

New Features

Auto mode tab added to /permissions

An Auto mode tab has been added to /permissions, allowing you to view and edit auto mode classifier rules.

For those who use auto mode daily and find it difficult to keep track of which tool calls are automatically approved, being able to view the rules in a list alone should reduce the effort of checking them.

Startup warning for Bash allow rules with wildcards before subcommands

When a wildcard is placed before a subcommand in a Bash allow rule (e.g., Bash(git * main)), a warning is now displayed at startup because it also matches options inserted before the subcommand.

If you remember writing allow rules with wildcards before subcommands in the past, it's worth checking whether a warning appears at startup.

Bug Fixes

Issue where manually created git worktrees were being deleted

A bug where the background session retention period sweep was deleting manually created git worktrees under .claude/worktrees/ that were referenced by old background session records has been fixed.

For those who create their own worktrees under .claude/worktrees/ to work with, this is a fix worth prioritizing an upgrade for.

Issue where resumed sessions failed with 400 errors every turn

A bug where resumed sessions failed with 400 errors every turn when the saved history contained tool blocks not accepted by the Anthropic API (typically written by third-party API proxies) has been fixed.

If you have sessions that became unable to resume while using a third-party API proxy, it's worth trying to open them again.

Issue where the Write tool stalled after overwriting large files

A bug where after overwriting a very large existing file, the Write tool would report "Out of memory" or freeze for a long time despite the write itself having completed has been fixed.

Those who have experienced Claude Code freezing during tasks that rewrite huge files all at once are likely to feel the most benefit from this fix.

Security

Issue where API keys for third-party gateways were being sent in requests to Anthropic

A bug where telemetry and metrics requests to Anthropic were sending API keys configured for third-party gateways (ANTHROPIC_BASE_URL) has been fixed. Credentials are now only sent to their own host.

For environments running with ANTHROPIC_BASE_URL set, such as Bedrock or self-hosted gateways, this feels like a high-priority fix.

Approval of malformed commands with trailing && / ||

The Bash permission check has been fixed to always require approval for malformed commands with && or || remaining at the end.

Those who manage shell command allow rules in detail may find that some previously accepted patterns now trigger approval prompts.

Issue where sandbox did not respect --setting-sources

A bug where the command sandbox filesystem configuration did not respect --setting-sources has been fixed.

If you are using the sandbox while restricting which settings are loaded with --setting-sources, it's worth checking whether the intended restrictions were actually in effect.

Update Contents

Security

• When a wildcard is placed before a subcommand in a Bash allow rule (e.g., Bash(git * main)), a warning is now displayed at startup because it also matches options inserted before the subcommand.
• Fixed a bug where telemetry and metrics requests to Anthropic were sending API keys configured for third-party gateways (ANTHROPIC_BASE_URL). Credentials are now only sent to their own host.
• Fixed the Bash permission check to always require approval for malformed commands with && or || remaining at the end.
• Fixed a bug where the command sandbox filesystem configuration did not respect --setting-sources.
• Fixed a bug where sessions that ended in plan mode were being resumed outside of plan mode in the VS Code extension and in claude -p --continue / --resume using permission prompt tools, when no permission mode was set.
• Fixed a bug where "Yes, and don't ask again" was being shown in permission prompts for MCP tools with requiresUserInteraction specified. This option was writing allow rules that the tool would then ignore.

New Features

• An Auto mode tab has been added to /permissions, allowing you to view and edit auto mode classifier rules.
• The time elapsed line at the end of a turn now includes the time at which that turn completed (e.g., ✻ Sautéed for 23s · done 6:05 PM).

Improvements

• /cd has been improved so that project settings, hooks, .mcp.json servers (via the normal approval prompt), skills, and agents for the destination directory take effect immediately after moving, without waiting for --resume.
• Bash tool latency in bash shell has been improved. When replaying snapshot functions, a base64 subshell is no longer launched for each individual function.
• Sub-agent results have been improved. Sub-agents that stop at the maxTurns limit now return with a note indicating output is partial and a hint that they can be continued with SendMessage, rather than appearing to have completed normally.
• Non-interactive sessions (-p, SDK, cloud sessions) have been improved to automatically continue responses that were cut off mid-stream due to server errors, connection drops, or interruptions, instead of terminating with an error.
• /code-review has been changed so that Claude can initiate it autonomously even on Bedrock, Vertex AI, Foundry, via the Claude app gateway, and in environments where telemetry and non-essential communications are disabled.
• /goal: Check-ins that idle sessions perform for long-running background tasks have been changed to a maximum of 3 times per goal. Sending the next message allows 3 more.
• claude install and claude update have been changed to defer consent prompts for pending managed settings to the next interactive session rather than showing them during command execution.
• OpenTelemetry events for plugins synced from claude.ai have been changed. plugin_id_hash now reflects the plugin's original marketplace, and enabled_via is admin-install for plugins installed by an administrator.
• Organization attribution of usage telemetry has been improved for workload identity federation sessions, events sent while apiKeyHelper is running at startup, and after login tokens expire while idle.

Fixes

• Fixed accidental deletion of manually created git worktrees: Fixed a bug where the background session retention period sweep was deleting manually created git worktrees under .claude/worktrees/ referenced by old background session records.
• Fixed 400 errors in resumed sessions: Fixed a bug where resumed sessions failed with 400 errors every turn when the saved history contained tool blocks not accepted by the Anthropic API (typically written by third-party API proxies).
• Fixed Write tool Out of Memory and freezing: Fixed a bug where after overwriting a very large existing file, the Write tool would report "Out of memory" or freeze for a long time despite the write itself having completed.
• Fixed issue where background sessions could not be opened: Fixed a bug where background sessions would become unable to open after 45 seconds when the Claude Code startup directory had been deleted, the machine had gone to sleep, or the host's process startup was slow.
• Fixed display lag in diffs containing long single lines: Fixed a bug where transcripts would become extremely slow when a diff contained a very long single line (such as a base64 string). Affected lines are now truncated with a marker.
• Fixed memory growth in transcript display: Fixed a bug where memory would grow as sessions got longer in fullscreen and Ctrl+O transcript display. Each rendered message line no longer retains the entire tool reference table for the whole transcript.
• Fixed issue where changes from simultaneous launches were mixed together: Fixed a bug where /ultrareview runs and cloud sessions launched simultaneously from a single repository (e.g., from multiple worktrees) would sometimes start incorporating uncommitted changes from a different launch.
• Fixed installation script failures: Fixed a bug where curl -fsSL https://claude.ai/install.sh | bash would fail with "Raw mode is not supported" for some Team/Enterprise users using server-managed settings.
• A quietly welcome fix: Fixed a bug where the /stats activity heatmap was displayed one cell off in timezones east of UTC (Sunday counts appearing in the Monday position). Since this is a display you see every day when using Claude Code in timezones east of UTC like Japan, it's a small but welcome fix.
• In addition, numerous minor bugs have been fixed in areas including plugin installation and updates, MCP tool argument handling, custom theme colors and keybindings.json, input around the @ file picker, and session lists in claude agents.

Trying Out the Bash Allow Rule Warning

I'll verify that a startup warning actually appears for allow rules with wildcards placed before subcommands. To avoid modifying global settings, I ran the command by passing a temporary JSON string to --settings.

First, here is the case where Bash(git * main) — the target of the warning — is specified as an allow rule.

% claude --settings '{"permissions":{"allow":["Bash(git * main)"]}}' -p '1+1は?'
Permission allow rule (/tmp/claude-501/claude-settings-ba7b258ec14cb7e1.json): Bash(git * main) 
has a wildcard before the rest of the command, so it also matches any options inserted at that 
position and approves them without a prompt. For git, options such as -c and --exec-path can run 
arbitrary commands. Replace that * with the exact value you mean, or only use * after the 
subcommand (for example Bash(git status *)).
2 です。

The warning was displayed. Which rule is problematic, why it is problematic (arbitrary commands can be executed with options like -c and --exec-path), and how to fix it are all summarized in a single message.

For comparison, I also ran it with the form recommended in the warning — placing the wildcard after the subcommand (Bash(git status *)) .

% claude --settings '{"permissions":{"allow":["Bash(git status *)"]}}' -p '1+1は?'
2 です。

No warning was displayed here. The exit code is 0 in both cases.

Since the warning message even names specific options like -c and --exec-path, you can tell at a glance what the danger is just by reading it. I think it serves as a useful prompt to review allow rules you wrote in the past.

Trying Out the Auto Mode Tab in /permissions

In auto mode, classifier rules determine whether tool calls should be automatically approved. The Auto mode tab added in v2.1.246 makes it possible to view and edit these rules from within /permissions.

Since the tab is an interactive UI, the steps are as follows:

1. Launch claude
2. Run /permissions
3. Switch the tab to Auto mode
4. Review the displayed classifier rules; selecting View in Editor (code) launches an editor where you can make edits.

Even with just the default rules, there are 67 soft denies, and reading through the JSON is a laborious task. I feel it is significant that a tab accessible from /permissions has been provided.

Closing Thoughts

With 44 of 61 changes being fixes, v2.1.246 feels like a consolidation-focused release. Among those, the fix for API keys intended for third-party gateways leaking into Anthropic telemetry, and the addition of warnings for Bash allow rules, strike me as changes that tighten up the handling of permissions and credentials by a meaningful degree.

For those who have written Bash allow rules in settings.json, why not update and check whether any startup warnings appear?

References

https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

https://code.claude.com/docs/en/changelog

https://dev.classmethod.jp/articles/20260825-cc-updates-v2-1-245/