Claude Code 2.1.246 flags wildcard Bash allow rules

Claude Code 2.1.246 adds a startup warning for Bash allow rules that place a wildcard before the subcommand, such as Bash(git * main), because those rules also match options inserted ahead of the subcommand. The warning appears in the release notes published on Github.

At a glance

• A new Auto mode tab in /permissions lets classifier rules be viewed and edited, and auto mode tool calls on very large sessions no longer fail as temporarily unavailable.
• Telemetry and metrics requests to Anthropic stopped carrying the API key configured for a third-party gateway through ANTHROPIC_BASE_URL; a credential is now sent only to its own host.
• The end-of-turn duration line now shows when the turn finished, as in Sautéed for 23s · done 6:05 PM, and /cd applies the new directory's settings immediately.

Permission syntax that quietly matches more than it appears to is a long-standing hazard in allow-listed tooling, and a wildcard placed before a subcommand covers anything the shell inserts in front of it. The credential fix points the same way: routing traffic through a third-party gateway likely widened the set of hosts that saw an API key. Both changes look like tightening of defaults rather than new capability.

Bash checks now always require approval for commands with a dangling && or ||

Beyond the startup warning, Bash permission checks now always require approval for malformed commands with a dangling && or || operator. Sessions started with --strict-mcp-config no longer prompt to approve .mcp.json servers they would never load, a prompt that had left background sessions waiting at startup.

MCP tools marked requiresUserInteraction no longer offer "Yes, and don't ask again" in their permission prompt, an option that wrote an allow rule the tool then ignored. A keybindings.json entry with an unknown action name is now skipped instead of deadening the key, and the warning is logged under --debug.

Usage telemetry attribution to the organization improved for workload identity federation sessions, for events sent while apiKeyHelper runs at startup, and after a login token expired while idle. A visible API error on the first prompt after idle with short-lived JWTs is gone: an expired cached token is refreshed before sending, and 401/403 auth errors retry quietly.

Background sessions no longer fail to open after 45 seconds on slow or slept hosts

Background sessions had failed to open after 45 seconds when Claude Code's starting directory had been deleted, when the machine had slept, or on hosts slow to start processes. A second failure, "Couldn't start the background service … EACCES", hit when another Claude Code process was re-installing the npm package.

The retention sweep stopped removing hand-created git worktrees under .claude/worktrees/ when an old background-session record pointed at them. In claude agents, a backgrounded named session was listed twice; the same conversation backgrounded again now numbers the new row, as in my-session (2). Pressing ← or running /background during a dynamic workflow no longer restarts finished subagents silently; it asks first and states how many would restart.

/cd now applies the new directory's project settings, hooks, .mcp.json servers behind the usual approval prompt, skills and agents right after the move rather than on --resume. Bash tool latency on bash shells improved by replaying snapshot functions without a base64 subshell per function.

A single base64 line in a diff no longer stalls the transcript

A diff containing a very long single line, such as a base64 string, had caused a severe transcript slowdown; such lines now render truncated with a marker. Fullscreen mode had shown a blank transcript after a terminal resize and a jump to the bottom until the next keypress, and scrolling from an earlier message was erratic, with jump-to-bottom getting stuck mid-transcript.

Memory growth with session length in the fullscreen and Ctrl+O transcript views is addressed: a rendered message row no longer retains a full copy of the transcript-wide tool lookups. Markdown rendering had been disabled for a whole message when its first 500 characters contained no markdown, and for +/N) lists and setext headings. The Write tool had reported "Out of memory" or frozen after overwriting a very large existing file that had been written.

Three check-ins per goal

/goal limits idle sessions to three check-ins on long-running background work per goal, and the next message allows three more. Non-interactive sessions, including -p, the SDK and cloud sessions, now continue a response cut off mid-stream instead of ending with an error.

A subagent that stops at its maxTurns limit returns its output marked as partial, with a hint to continue it through SendMessage. claude install and claude update defer a pending managed-settings consent prompt to the next interactive session, and the notes give no date for the following release.