Claude Code 2.1.246: audit Bash wildcard rules before trusting Auto mode
Quick answer
Claude Code 2.1.246 adds a startup warning for Bash allow rules whose first wildcard appears before the subcommand, such as Bash(git * main). That pattern does not mean “safe Git operations on main.” The wildcard can stand for any Git subcommand and options placed before it, so the same rule can match git merge main, git push origin main, or a git -c ... command.
The release also adds an Auto mode tab to /permissions. Treat the two changes as one migration task: inventory every effective Bash rule, remove ambiguous middle wildcards, put a wildcard only after the exact subcommand you intend to allow, and keep destructive or external actions behind an ask rule, a blocking PreToolUse hook, and OS-level sandbox limits.
Who this is for
This guide is for developers and teams that keep Claude Code permissions in user, project, local, or managed settings, especially if they use Auto mode, background sessions, CI, or shared repository configuration.
If an agent opens untrusted repositories, pair this audit with the untrusted-repository sandbox checklist. For earlier path, marketplace, and redaction gates, see the Claude Code 2.1.234 security canaries.
What changed—and what it does not prove
| Surface | Confirmed in 2.1.246 or current docs | Boundary |
|---|---|---|
| Startup audit | Claude Code warns about an allow rule with * before the subcommand |
A warning does not rewrite or disable the rule |
| Wildcard semantics |
* matches any text, including spaces |
A branch name or final argument does not constrain the operation |
/permissions |
Auto mode classifier rules now have a visible tab when Auto mode is available | Visibility is not proof that every action is safe or approved |
| Rule order | Deny, then ask, then allow | A narrow allow cannot override a matching broad deny or ask |
| Compound commands | Recognized shell-separated commands are checked independently | A text rule is still not an OS sandbox |
| Hooks and sandbox | A blocking PreToolUse hook can stop a call before allow rules; sandboxing restricts Bash at the OS layer |
Prompt instructions and CLAUDE.md alone are not enforcement |
This is a permissions-semantics release, not a claim that Auto mode is universally safe. Version 2.1.246 also fixes a malformed-command approval path and the command sandbox's handling of --setting-sources, but those fixes do not make a broad allow rule least-privilege.
Why Bash(git * main) is broader than it looks
Claude Code matches the text before the first wildcard as the fixed prefix. Compare four shapes:
| Rule | Effective scope | Audit decision |
|---|---|---|
Bash(git status) |
Exactly one command | Keep when the exact form is sufficient |
Bash(git log *) |
The git log subcommand with varying arguments |
Usually acceptable for a read-only task after canaries |
Bash(git * main) |
Any Git subcommand or option sequence ending in main
|
Remove or rewrite; 2.1.246 warns about this class |
Bash(git *) |
Every Git subcommand | Do not use as a convenience allow rule in a normal host environment |
The branch name is not a capability boundary. main may appear in a read, write, remote, or configuration-changing command. The current documentation explicitly shows that Bash(git * main) matches both git push origin main and a `git -c core.fsmonitor=
Top comments (0)