1
00:00:00,000 --> 00:00:02,880
G'day, brought to you by Jellypod AI.

2
00:00:03,000 --> 00:00:06,720
James, have you uh, have you updated to
the new Claude Code yet?

3
00:00:06,760 --> 00:00:09,360
The, the 2.1.207 release?

4
00:00:09,408 --> 00:00:12,880
They've-they've finally turned on Auto
Mode by default across the board.

5
00:00:13,040 --> 00:00:17,120
No more messing around with that
CLAUDE_CODE_ENABLE_AUTO_MODE env var if you're on

6
00:00:17,173 --> 00:00:19,414
Bedrock, Google Vertex, or Foundry.

7
00:00:19,468 --> 00:00:20,001
It's just...

8
00:00:20,001 --> 00:00:20,001
ready to roll.

9
00:00:20,308 --> 00:00:21,348
Oh, thank goodness.

10
00:00:21,846 --> 00:00:26,148
Honestly, having to set that environment
variable every time I spun up a new

11
00:00:26,204 --> 00:00:30,148
container or changed shells on Vertex was
a massive pain.

12
00:00:30,335 --> 00:00:34,308
So it's just, what, natively recognized
now across all those enterprise model

13
00:00:34,368 --> 00:00:34,868
gardens?

14
00:00:35,188 --> 00:00:36,228
Yeah, fair dinkum.

15
00:00:36,388 --> 00:00:37,748
It's built right in now.

16
00:00:37,988 --> 00:00:42,788
But-but-but here's the real kicker, and
this is a massive security update.

17
00:00:42,900 --> 00:00:46,708
They've completely hardened how autoMode
configurations are read.

18
00:00:46,921 --> 00:00:50,628
It used to be that Claude Code would look
at repo-level settings,

19
00:00:50,648 --> 00:00:57,348
you know, like .claude/settings.json or
.claude/settings.local.json

20
00:00:57,462 --> 00:00:59,988
inside a project you just cloned from
GitHub.

21
00:01:00,515 --> 00:01:04,755
Wait, so if I cloned a random public repo,
it could have a malicious

22
00:01:04,915 --> 00:01:07,955
.claude/settings.json in the git tree?

23
00:01:08,075 --> 00:01:12,115
And if I ran Claude Code in there, it
would just execut- wait,

24
00:01:12,142 --> 00:01:16,515
could it trigger a shell injection or
override my local permissions automatically?

25
00:01:16,808 --> 00:01:17,728
Exactly!

26
00:01:17,784 --> 00:01:18,328
Spot on.

27
00:01:18,448 --> 00:01:21,128
A total drive-by shell-injection
nightmare.

28
00:01:21,248 --> 00:01:26,248
You clone a repo, run Claude, and boom,
some dodgy custom settings block or

29
00:01:26,299 --> 00:01:29,408
permission-override script runs on your
machine.

30
00:01:29,528 --> 00:01:32,168
So now, the dev team has blocked that
entirely.

31
00:01:32,328 --> 00:01:35,128
It is strictly read from your global user
settings.

32
00:01:35,208 --> 00:01:40,328
That's ~/.claude/settings.json on Unix or,
you know,

33
00:01:40,568 --> 00:01:46,088
%USERPROFILE%\.claude\settings.json if
you're on Windows.

34
00:01:46,168 --> 00:01:46,968
Too easy.

35
00:01:47,466 --> 00:01:48,458
That makes complete sense.

36
00:01:48,602 --> 00:01:51,498
Keep the control global, not repo-local.

37
00:01:51,711 --> 00:01:56,138
So if I actually want to tweak it, like if
I want to turn off Auto Mode entirely,

38
00:01:56,218 --> 00:01:58,218
I have to use the global /config command?

39
00:01:58,330 --> 00:02:01,898
Like /config disableAutoMode=disable?

40
00:02:02,192 --> 00:02:02,992
Yeah, you got it.

41
00:02:03,312 --> 00:02:09,792
/config disableAutoMode=disable updates
that global config file directly.

42
00:02:09,952 --> 00:02:13,952
No more sneaky repo-level overrides
hijacking your terminal.

43
00:02:14,192 --> 00:02:15,872
I reckon it's a solid fix.

44
00:02:16,180 --> 00:02:20,340
Speaking of security, I saw they also
cracked down on custom plugins and hooks.

45
00:02:20,436 --> 00:02:25,820
They're rejecting any shell-form plugins
using ${user_config.*} variables now,

46
00:02:25,840 --> 00:02:26,020
right?

47
00:02:26,180 --> 00:02:30,100
To stop people from passing unescaped
config values straight into a shell command?

48
00:02:30,400 --> 00:02:31,280
Yeah, exactly.

49
00:02:31,413 --> 00:02:35,600
If you try to use those variables in a
custom plugin, it'll outright reject it.

50
00:02:35,696 --> 00:02:40,240
They're pushing everyone to use exec-form
or the proper env vars like

51
00:02:40,320 --> 00:02:41,760
$CLAUDE_PLUGIN_OPTION_