Update Claude Code now. Your deny rules had gaps

Claude Code 2.1.289 fixes several paths that could stop deny and approval rules from working as intended. Three gaps stand out:

1. Nested compound commands. A deny or ask rule on part of a compound shell command now keeps holding when a user-installed mod requests approval on a managed machine.
2. Environment-prefixed commands. Bash rules could miss a command preceded by an environment-variable assignment, especially with sandbox auto-allow on. Both expanded-value and bare-assignment cases are fixed.
3. Symlinked file access. A denied file should not be readable through a symlink.

Permission systems have to judge what a command actually runs, not just its simplest visible form. Compound syntax, environment prefixes and filesystem indirection can all open a gap between the policy you wrote and what the agent does.

Run claude --version. If you are below 2.1.289, update before your next autonomous or managed-machine session. Then, in a disposable repository, check that:

• A denied command stays blocked inside a compound command
• A denied command stays blocked after an environment-variable assignment
• A denied file cannot be read through a symlink
• Organization-managed MCP sign-in descriptions cannot be changed by a user plugin

Keep the tests harmless: temporary files and commands that only print a message.

The catch: this release does not make unattended coding agents automatically safe. It makes Claude Code’s existing review boundaries more dependable.