Five Claude Code 2.1.289 fixes to read against your rules

The Claude Code changelog dates version 2.1.289 to October 3, 2026. Five entries in that version belong on a permission review. Four are rules the note says were not holding, were not applying, were missing a command, or were skipped. The fifth is a user-installed plugin that could rewrite the descriptions of an organization-managed MCP server’s sign-in tools. The same page says, “Run claude --version to check your installed version.”

If you are the person who writes those rules, this release is a reading list with conditions attached. The notes name each case and give no counts.

Four rules that were not applied

On managed machines, a deny or ask rule on a nested part of a compound shell command was not holding over a user-installed mod’s approval. Keep the three conditions together. The machine is managed. The mod is one the user installed. The rule points at a nested part of a compound shell command. Version 2.1.289 lists that case as fixed.

Read deny rules were not applying to files @-mentioned, changed, or selected in the IDE through a symlink. Those are the three IDE actions in the note, and each one is through a symlink. Version 2.1.289 lists that as fixed.

Two further entries are Bash rules, and the changelog ties both to sandbox auto-allow.

Bash deny and ask rules were missing a command behind an environment-variable prefix with an expanded value, when the sandbox auto-allows commands. Version 2.1.289 lists this as fixed.

A separate entry says a Bash deny or ask rule was skipped under that same auto-allow when a bare variable assignment came before the command. Version 2.1.289 lists this skip as its own fix.

Sign-in tool descriptions

A user-installed plugin could rewrite the descriptions of an organization-managed MCP server’s sign-in tools. The server in the note is managed by the organization. The plugin is one a user installed. The text that could change is the description of those sign-in tools. Version 2.1.289 says that rewrite is fixed.

Treat this as its own row. Write down each sign-in tool’s description, and write down the user-installed plugins on that machine. The note says a plugin in that class could rewrite the descriptions. It names no plugin.

One line, read as a row

Use the symlink entry as the pattern for the other four.

The behavior the note says it fixed: Read deny rules were not applying. The paths: files @-mentioned, changed, or selected in the IDE. The condition: through a symlink. The version that lists the fix: 2.1.289.

The row asks whether that condition is present on a machine you run, and it asks you to open that machine before you answer. If a file there can be @-mentioned, changed, or selected in the IDE through a symlink, the row stays open until you have looked at that path against your Read deny rules. If no file there is @-mentioned, changed, or selected in the IDE through a symlink, the row is no.

Copy the same split onto every other entry. Behavior fixed. Paths or commands. Condition. Version. Then the yes, no, or not yet.

A five-row re-check

Mark a row no when the changelog’s condition is absent on that machine. Mark it yes only after you have opened the setting. Otherwise mark it not yet.

1. Mod approval on a managed machine. Condition: managed machines. Open user-installed mods and any deny or ask rule on a nested part of a compound shell command. The note says that rule was not holding over the mod’s approval.
2. Read deny rules and a symlink. Condition: a file @-mentioned, changed, or selected in the IDE through a symlink. Open the Read deny rules and those paths. The note says the Read deny rules were not applying.
3. Sign-in tool descriptions. Condition: an organization-managed MCP server with sign-in tools, where users can install plugins. Record each sign-in tool’s description and the user-installed plugins. The note says such a plugin could rewrite those descriptions.
4. Environment-variable prefix. Condition: the sandbox auto-allows commands. Read the Bash deny and ask rules against a command behind an environment-variable prefix with an expanded value. The note says those rules were missing that command. When auto-allow is off, mark the row no.
5. Bare variable assignment. Condition: sandbox auto-allow is on. Read the same Bash rules against a bare variable assignment before the command. The note says the rule was skipped in that shape. When auto-allow is off, mark the row no.

Five rows. Three answers. Filled in from machines you actually run.

What to do this week

• Run claude --version wherever Claude Code runs a task. The changelog names that command for checking the installed version.
• Set the printed number beside 2.1.289, dated October 3, 2026. The five fixes above are listed under that version.
• Fill in the five rows. Use yes, no, or not yet.
• On each managed machine, list user-installed mods before you mark the first row no.
• Where sandbox auto-allow is on, mark the two Bash rows only after you have read those rules against the two shapes the changelog names.

If you want a second person on that pass, CTO of One consults in five-hour blocks at $400 an hour.