Claude Code's deny rules on /tmp and /etc missed paths given by their real location

The two symlink failures hit the same rule from two directions. Deny and ask rules on symlinked directories did not apply when the path was given by its real location, and the roundup lists /etc, /tmp and /var on macOS and /bin on Linux ^[3]. Bash commands, separately, ignored deny rules written against the symlinked spelling ^[4]. Whichever spelling an author picked, one of the two paths went unchecked ^[1].

The second case is about what the checker does when it cannot read the line. The permission checker works out which files a Bash command will touch. env -C runs its command after changing directory, and eval expands a string at runtime. When one of those appeared on the same line, a Read or Edit deny rule could fail to apply ^[5]. The roundup puts both cases in one class: "Both are the same class of problem: a prohibition you wrote was not actually in force." ^[6]

Features were the minor part of the week. The same pair of Claude Code releases added claude plugin eval, which scores a plugin's eval suite and writes JSON and HTML reports, /output-style switching that works in cloud and headless sessions, Bash edit diffs behind bashEditDiffEnabled, and a per-run concurrent agent limit settable from 1 to 256 ^[10].

Gemini CLI 0.59.0 also tightened trust. Its release notes list two substantive changes, both security fixes: SSRF prevention in MCP OAuth metadata discovery and authentication, filed as PR #29081, and enforcement of fail-closed workspace trust with mcpServer filtering ^[17]. The roundup describes the week across all three tools as light on features and heavy on closing permission and security gaps ^[18].

Codex CLI 0.154.0 also moves the Python SDK, and the roundup names no replacement for the removed mcp-server entry point. HookMetadata now wraps its handler in .root, so hook.command becomes hook.root.command, and handler-specific fields need a hook.root.handler_type check first ^[16]. In Python, that kind of change shows up at runtime. Trust handling changed too: startup avoids running workspace-controlled helpers before trust is established, and the macOS sandbox blocks terminal input injection ^[15].

Count what 2.1.268 closes and it comes to four described defects: two deny bypasses and two secret-disclosure bugs ^[2]. The second disclosure bug showed a token or password contained in a git source URL in plugin and marketplace errors ^[8]. The roundup's advice is blunt: "If you rely on deny rules to protect parts of your codebase, update first and read the rest later." ^[19] A deny rule binds the way its author intended only when the file tools and the Bash path agree on how a path is spelled and the checker refuses a line it cannot analyze, and before 2.1.268 neither of those was in place ^[2].