1
00:00:00,540 --> 00:00:05,360
Man, I was just tweaking my terminal
aliases this morning-trying to get my nested

2
00:00:05,493 --> 00:00:10,800
tmux sessions to play nice-when the update
notification for Claude Code popped up on

3
00:00:10,827 --> 00:00:11,440
my screen.

4
00:00:11,680 --> 00:00:15,040
This is brought to you by Jellypod AI, by
the way.

5
00:00:15,240 --> 00:00:21,920
But, oh mate, the 2.1.207 release has a
massive security change

6
00:00:22,016 --> 00:00:25,760
that completely shifts how we handle local
workspace configs.

7
00:00:25,984 --> 00:00:30,480
They completely killed repository-level
autoMode overrides.

8
00:00:31,047 --> 00:00:32,055
Wait, really?

9
00:00:32,135 --> 00:00:38,855
So the .claude/settings.local.json file
inside a specific repo can't configure Auto

10
00:00:38,903 --> 00:00:40,135
Mode permissions anymore?

11
00:00:40,708 --> 00:00:41,618
Nah, dead and buried.

12
00:00:41,911 --> 00:00:48,018
If you have autoMode.allow or even
autoMode.soft_deny defined in your local

13
00:00:48,178 --> 00:00:53,618
.claude/settings.local.json inside a
project folder, the parser in version

14
00:00:53,698 --> 00:00:57,378
2.1.207 just flat-out ignores them now.

15
00:00:57,538 --> 00:01:02,258
They absolutely must live in your global
user config file at

16
00:01:02,518 --> 00:01:05,938
~/.claude/settings.json instead.

17
00:01:06,429 --> 00:01:11,267
Okay, that makes total sense because
otherwise, you could clone some random public

18
00:01:11,332 --> 00:01:16,307
repository, run the tool, and-if that repo
shipped with its own malicious

19
00:01:16,507 --> 00:01:23,107
.claude/settings.local.json-it could
silently whitelist dangerous bash commands

20
00:01:23,134 --> 00:01:23,747
under the hood.

21
00:01:23,907 --> 00:01:28,227
You'd basically give an untrusted repo
free rein on your local machine the moment

22
00:01:28,247 --> 00:01:29,667
you initiated Claude Code.

23
00:01:30,283 --> 00:01:31,147
Spot on, James!

24
00:01:31,334 --> 00:01:34,907
It was a classic local repo-hijack vector.

25
00:01:35,067 --> 00:01:40,347
Some bad actor could commit a sneaky local
config whitelisting things like curl

26
00:01:40,427 --> 00:01:44,987
pipes or file deletions, and you wouldn't
notice until your system was already

27
00:01:45,047 --> 00:01:45,787
compromised.

28
00:01:45,987 --> 00:01:51,067
Now, to fix this, if you've got custom
workspace-specific rules,

29
00:01:51,087 --> 00:01:54,987
you've got to manually pull those settings
out of your project directories and

30
00:01:55,057 --> 00:02:01,547
migrate them directly into your global
~/.claude/settings.json file.

31
00:02:02,067 --> 00:02:06,103
And if developers aren't sure if they've
got active repository-level configurations

32
00:02:06,139 --> 00:02:09,943
floating around their machines, they need
to manually inspect their active project

33
00:02:09,990 --> 00:02:10,583
directories.

34
00:02:10,743 --> 00:02:15,783
It's basically a manual audit of any local
.claude folders to ensure those JSON

35
00:02:15,827 --> 00:02:19,303
structures aren't silently failing to
execute commands they used to automate.

36
00:02:20,278 --> 00:02:20,658
Exactly.

37
00:02:20,718 --> 00:02:24,018
You've got to do a quick manual check of
your workspace configs.

38
00:02:24,198 --> 00:02:28,738
But, hey, there's actually a really nice
quality of life fix in this release too,

39
00:02:28,782 --> 00:02:32,018
especially for developers who use custom
environment setups.

40
00:02:32,158 --> 00:02:36,898
The auto-updater now respects custom
wrapper scripts or symlinks located at

41
00:02:37,178 --> 00:02:43,778
~/.local/bin/claude instead of ruthlessly
overwriting them on an update.

42
00:02:43,922 --> 00:02:48,978
Plus, if you run the /doctor command, it
actually detects and reports if you're

43
00:02:49,018 --> 00:02:51,858
running one of these 'externally managed'
setups.

44
00:02:52,335 --> 00:02:57,295
Oh, that is a huge relief for anyone
managing their environment with custom bash or

45
00:02:57,455 --> 00:02:58,735
zsh wrappers.

46
00:02:58,835 --> 00:03:04,895
And speaking of CLI improvements, I saw
they also tweaked autocomplete in 2.1.206.

47
00:03:05,015 --> 00:03:10,895
Now when you use /cd, you get matching
directory suggestions like /add-dir right

48
00:03:10,935 --> 00:03:12,335
there in the interactive prompt.

49
00:03:13,108 --> 00:03:14,708
Oh, mate, that's beautiful.

50
00:03:14,921 --> 00:03:18,628
No more typing blind and hoping you didn't
fat-finger the path.

51
00:03:18,848 --> 00:03:22,708
And they also fixed the /commit-push-pr
command.

52
00:03:22,868 --> 00:03:27,188
It used to force your push straight to
origin, which was a massive pain if you were

53
00:03:27,228 --> 00:03:31,348
working in a fork and wanted to push to a
custom upstream or whatever you had

54
00:03:31,392 --> 00:03:33,348
configured in your git configuration.

55
00:03:33,568 --> 00:03:39,908
Now, it natively respects your local
remote.pushDefault settings or just defaults to

56
00:03:39,928 --> 00:03:42,148
the sole remote if that's all you've got.

57
00:03:42,657 --> 00:03:43,905
That's a solid fix.

58
00:03:43,985 --> 00:03:48,145
It makes working with forks and upstream
remotes infinitely smoother without having

59
00:03:48,198 --> 00:03:51,265
to drop out of the Claude session to
handle the git push manually.

60
00:03:51,415 --> 00:03:55,745
Alright, that's the main security and
pipeline updates for this cycle.

61
00:03:56,257 --> 00:03:56,773
Too right.

62
00:03:56,920 --> 00:03:58,453
Catch you next time, mate.