Man, I was just tweaking my terminal aliases this morning-trying to get my nested
tmux sessions to play nice-when the update notification for Claude Code popped up on
my screen.
This is brought to you by Jellypod AI, by the way.
But, oh mate, the 2.1.207 release has a massive security change
that completely shifts how we handle local workspace configs.
They completely killed repository-level autoMode overrides.
Wait, really?
So the .claude/settings.local.json file inside a specific repo can't configure Auto
Mode permissions anymore?
Nah, dead and buried.
If you have autoMode.allow or even autoMode.soft_deny defined in your local
.claude/settings.local.json inside a project folder, the parser in version
2.1.207 just flat-out ignores them now.
They absolutely must live in your global user config file at
~/.claude/settings.json instead.
Okay, that makes total sense because otherwise, you could clone some random public
repository, run the tool, and-if that repo shipped with its own malicious
.claude/settings.local.json-it could silently whitelist dangerous bash commands
under the hood.
You'd basically give an untrusted repo free rein on your local machine the moment
you initiated Claude Code.
Spot on, James!
It was a classic local repo-hijack vector.
Some bad actor could commit a sneaky local config whitelisting things like curl
pipes or file deletions, and you wouldn't notice until your system was already
compromised.
Now, to fix this, if you've got custom workspace-specific rules,
you've got to manually pull those settings out of your project directories and
migrate them directly into your global ~/.claude/settings.json file.
And if developers aren't sure if they've got active repository-level configurations
floating around their machines, they need to manually inspect their active project
directories.
It's basically a manual audit of any local .claude folders to ensure those JSON
structures aren't silently failing to execute commands they used to automate.
Exactly.
You've got to do a quick manual check of your workspace configs.
But, hey, there's actually a really nice quality of life fix in this release too,
especially for developers who use custom environment setups.
The auto-updater now respects custom wrapper scripts or symlinks located at
~/.local/bin/claude instead of ruthlessly overwriting them on an update.
Plus, if you run the /doctor command, it actually detects and reports if you're
running one of these 'externally managed' setups.
Oh, that is a huge relief for anyone managing their environment with custom bash or
zsh wrappers.
And speaking of CLI improvements, I saw they also tweaked autocomplete in 2.1.206.
Now when you use /cd, you get matching directory suggestions like /add-dir right
there in the interactive prompt.
Oh, mate, that's beautiful.
No more typing blind and hoping you didn't fat-finger the path.
And they also fixed the /commit-push-pr command.
It used to force your push straight to origin, which was a massive pain if you were
working in a fork and wanted to push to a custom upstream or whatever you had
configured in your git configuration.
Now, it natively respects your local remote.pushDefault settings or just defaults to
the sole remote if that's all you've got.
That's a solid fix.
It makes working with forks and upstream remotes infinitely smoother without having
to drop out of the Claude session to handle the git push manually.
Alright, that's the main security and pipeline updates for this cycle.
Too right.
Catch you next time, mate.