Claude Code 2.1.221 closes two permission-check bypasses and adds credential masking

Today's release fixes, in Anthropic's own words, "a Bash tool permission-check bypass where zsh could execute hidden commands in [[ ]] regex conditionals; affected commands now prompt for permission," plus a PowerShell permission check that mishandled paths containing quote characters on Windows. It also adds mode: "mask" for sandbox credential files on Linux and WSL, where sandboxed commands read a sentinel copy, the whole file or just the spans matched by an extract regex, while the sandbox proxy substitutes the real value on egress. On macOS, file masking falls back to deny.

Why it matters: If your containment story is "the harness prompts before it runs anything I have not allowed," a class of shell constructs sat outside that boundary until today. Upgrade and inspect whatever else your permission layer pattern-matches on. The masking mode matters more in the long run: it lets an agent use a credential without ever reading it, which is the shape containment has to take before unattended runs touch anything real.