This episode is brought to you by Jellypod AI.
So, James, mate, if, if you are running multi terminal setups with Claude Code,
there was a pretty sneaky security hole in how inter session messaging worked.
Oh, absolute nightmare scenario!
If you had a background agent session using SendMessage, it could actually pass
prompts directly into another terminal running with bypassed permissions,
and, uh, execute arbitrary shell commands right on your machine.
Far out.
So if an unvetted background agent goes rogue, it could basically take over the
second session.
But version 2.1.228 fixes this, right?
Exactly.
The huge headline update is that cross session messages sent to a session running
with bypassed permissions are held for your approval.
You get explicit control before anything touches that elevated session.
Nice!
So, uh, how do we actually configure this in our setup?
Is it in the settings file?
Yeah, it is all managed inside your .claude/settings.json file,
either locally or globally.
They introduced two specific settings: crossSessionInbound and dialogExpiry.
Right, right.
So you set "crossSessionInbound" to, uh, "hold" so those messages do not just slip
through automatically?
Spot on.
You set "crossSessionInbound": "hold", and then you pair it with "dialogExpiry".
You can set dialogExpiry to a number like 300, or a string like "5m" for five
minutes.
Wait, let me guess why that expiry part is so crucial.
If you are running unattended sessions, like in automated CI CD pipelines or self
hosted runners...
if a prompt gets held and there is no human around to click approve...
It just hangs!
Without dialogExpiry, headless build pipelines would freeze indefinitely waiting for
approval that is never coming.
With the timeout, it safely fails or aborts after those five minutes.
Man, I have definitely had builds hang overnight because of a missing prompt timeout
before.
That is a life saver.
Totally.
And speaking of version 2.1.228, there are two other really nice quality of life
upgrades in this release that are worth calling out.
Oh yeah?
What else did they tweak?
First, the Write tool rules got updated.
Newer Claude models no longer need to make a mandatory Read tool call before
overwriting an existing file.
If the model wants to overwrite, it can just write straight away.
Oh, beautiful!
That extra read step used to burn unnecessary tokens and slow down file updates.
What was the second thing?
Sandboxing for synced skills!
Any skills synced from claude.ai are now sandboxed so they cannot execute
exclamation point shell commands, and they cannot use at symbol file path
expansions.
Ah, locking down those shell escapes and file path expansions keeps third party
skills strictly in their lane.
Proper security boundary there.
Exactly.
Securing inter session prompts and sandboxing skills in one tight release.
Pretty solid update all around.
Alright, go update your settings files, folks.
Catch you next time!