Claude Code 2.1.260 opens a live diff panel

On September 3, Anthropic shipped Claude Code 2.1.260. The release rolls back a permission change made the day before and fixes several permission-rule bugs, one of which left “read-only” folders writable. It also adds a /diff panel that shows uncommitted changes while Claude is still editing.

The release notes on GitHub list around seventy entries. Classmethod’s DevelopersIO counted 103 changes across 2.1.259 and 2.1.260 together, covering September 2 and 3, and classed 7 of them as security fixes and 4 as breaking changes. Most of the entries that change how you work involve the permission layer.

A rule that lasted a day

2.1.259, released on September 2, extended Read() deny rules to Bash. A file you had blocked from reading was supposed to stay blocked when it showed up as an option value (--ignore-revs-file=.env, -f.env, @file), as a file argument to git diff or git grep, or inside a compound command like cd DIR && cat FILE.

That broke ordinary builds. Under a rule like Read(./**/build/**), npm run build was denied in every mode, and cd … && grep asked for confirmation even in auto mode. 2.1.260 reverts the change.

The revert followed other permission changes in 2.1.259. That release also added --permission-prompts none for unattended headless hosts: anything that would show a prompt is denied automatically, while the active permission mode, auto included, keeps making decisions. And in August, 2.1.246 began warning about wildcard Bash allow rules like Bash(git * main), because they also matched options inserted before the subcommand. Over the past few releases, a lot of the work has gone into the gap between what a rule’s text says and what the matcher actually does.

Deny rules that didn’t hold

Three fixes in 2.1.260 deal with rules that did not do what they said.

The first involves parentheses in paths. An Edit, Write or Read rule whose path contained parentheses was either dropped as invalid or ignored by the Bash sandbox, which left “read-only” folders writable. A related settings error now flags Windows-style rules like Edit(C:\dir\(name)\**), where \( is read as an escaped parenthesis instead of a path separator, and suggests an unambiguous spelling.

The second was loud. A single file permission rule whose pattern could not be compiled, such as one with an unclosed [, made every file edit fail with Invalid regular expression. A deny rule like that now guards the literal path it spells.

The third affects zsh users. The Bash permission check auto-approved zsh commands that hid a command substitution (a nested $(…) that runs another command) inside an assignment to REPORTTIME, REPORTMEMORY or DIRSTACKSIZE. A command could look like a harmless variable setting while running something else. These commands now prompt for approval.

Several smaller changes go the same way:

• Permission rules with text after the closing parenthesis, like Bash(ls) x, never matched anything and were silently ignored. They are now reported as invalid settings.
• On macOS, permissions.blockReadsOutsideWorkingDirectories hid the user’s git config from sandboxed git, and hid a worktree-isolated sub-agent’s own checkout.
• Skill(name) deny rules didn’t cover a nested skill listed as <dir>:name, and managed skillOverrides keyed on a bundled skill’s alias (such as checkup for /doctor) didn’t apply.
• Glob and Grep checked whether the search path existed on disk before the permission check. A missing path is now reported after the permission decision, the same way Read handles it.

Two changes loosen things deliberately. Commands typed at the ! bash-mode prompt now run outside the sandbox even when strict sandbox mode (sandbox.allowUnsandboxedCommands: false) is on, the same as typing into your own terminal. And a managed CLAUDE.md delivered through server-managed settings no longer triggers the security approval dialog. Managed hooks, shell-command, sandbox and unsafe env settings still require approval.

What /diff shows

The panel opens beside the conversation in fullscreen mode, fills with uncommitted changes as Claude edits, and closes when you run /diff again. It shows only uncommitted work, so anything already committed doesn’t appear. Until now, checking changes mid-turn meant running git diff in another terminal, waiting for the end-of-turn summary, or switching to an editor’s source control view.

Fullscreen gets two more changes. ctrl+l / cmd+k now clear the transcript view the way a terminal clear does, and earlier messages are still there if you scroll up. Ctrl+Z in fullscreen no longer leaves the shell on the alternate screen, drawn on top of the paused interface.

Cache misses get a reason

/cost and the status line’s prompt_cache field now give a likely cause for a prompt-cache miss, such as changed tool definitions or system prompt, or a session left idle past the TTL. Claude Fable 5.1 gets its own set of fixes:

• Prompt caching didn’t cover context attached after tool results, so that context was re-sent as uncached input on every tool-call turn.
• Changing /effort mid-session no longer invalidates the prompt cache.
• Agents set to model: fable ignored the [1m] tag on an ANTHROPIC_DEFAULT_FABLE_MODEL pin and silently ran with a 200K context window.
• The /model picker didn’t list Fable 5.1 for organizations that can use it. It was only accepted when typed as /model claude-fable-5-1.

Auto-compact for 1M-context models changed as well. Opus and Fable sessions now compact shortly before the 1M-token limit, and recovery compaction on very large contexts no longer times out at 10 minutes.

Agents, rewind and headless runs

/rewind and --rewind-files reported success when checkpoint backup files were missing and nothing had actually been restored. That is fixed. So is stale file-read tracking from rewound turns, which produced “File unchanged since last read” stubs and re-injected whole files after external edits.

For multi-agent setups:

• Background commands started by subagents no longer have a one-hour limit. They run until they exit or are stopped, matching the main session.
• A subagent that resumed another agent through SendMessage was never woken when that agent finished, because the notification went to the main conversation.
• Workflow tool subagents were restarted as stalled while a long context compaction was still running.
• A session moved to the background appeared twice in ListAgents, once as a phantom “interactive” twin with the same name.
• -p --resume and --continue, which the desktop app uses, failed on every retry once a session’s worktree directory lost its git metadata. They now fail once, then resume without the worktree.

Headless (-p / SDK) sessions use less CPU when idle and gain a text form of /advisor (/advisor <model>, /advisor off) and /reload-plugins. Self-hosted runners with --kill-session-after-min now release a session that is only waiting on its user, which stays resumable on the next message, instead of killing it and reporting a failure. /ultrareview waits up to 45 minutes for cloud reviews, up from 30.

For admins

The Claude apps gateway gets oidc.scope_on_refresh for identity providers that return an id_token on refresh only when openid is requested again. It also refuses to start, and names the field, when a desktop policy misspells a field nested inside a managedMcpServers or orgPluginSettings entry. On Amazon Bedrock, the gateway now counts input tokens for aborted requests with AWS’s free CountTokens API instead of a one-token request, which requires granting bedrock:CountTokens. Bedrock users whose corporate root CA sits only in the OS certificate store no longer get “unable to get local issuer certificate” on model discovery, token counting and AWS SSO/STS calls.

Managed settings failed to load for claude.ai Enterprise and Team users who had a leftover API key from an earlier /login. That is fixed, and /status now marks which of the two credentials is not in use. Claude in Chrome now follows the organization’s admin setting: when an admin turns it off, --chrome, /chrome and the browser tools are unavailable.