Claude Code 2.1.281 adds checks for sessions nobody is watching

Per the changelog, a recursive rm whose target is only command-substitution output, such as rm -rf "$(pwd)", ran "unprompted in auto and --dangerously-skip-permissions mode". It now asks, even with a Bash allow rule. In those modes the dangerous rm prompt now waits two minutes, then denies the command with a rewrite hint "so unattended sessions keep going". Where the auto mode classifier runs server-side, read-only and sandboxed shell commands now also wait for its review and are blocked when it flags them.

Other fixes close gaps in how restrictions carry over. --setting-sources was not forwarded to spawned sessions; teammates, /bg, claude agents sessions and --worktree --tmux "now start with the parent's restriction." claude --bg now asks for workspace trust before running project hooks. A permission rule containing a NUL byte had been expanded into a wildcard match and now matches nothing. A turn that could retry indefinitely while ignoring --max-turns is fixed. One change can break setups: self-hosted runners now pass system prompts as files, so a wrapper or hook that appends --system-prompt must switch to --system-prompt-file. The entry does not mention the AGENTS.md loading fix that a Hacker News commenter had said was due the same day.

Why it matters: Several of these fixes close ways a run with no one at the keyboard could do more than its settings allowed: remove its own working directory, start a spawned session without the parent's restrictions, or read a malformed rule as allow-all. If you run auto mode or skip permissions, upgrade, and check any runner wrapper that appends --system-prompt before it picks up the change.