Claude Code 2.1.280 closes a symlink gap in its permission checks

The release fixes "writes through a symlinked path being judged by their in-tree spelling." Per the entry, the permission prompt now names where the write lands, and "acceptEdits, allow rules and auto mode no longer approve one landing outside" the project. The changelog does not say how long the behavior existed or whether anyone exploited it.

Two auto mode fixes change how a stuck session ends. When a safety check declined to review an action, auto mode retried it "over and over"; the action is now denied once, with a note that retrying won't help. When a safety check gave no answer, retries now back off, and the turn stops with a message after ten in a row. Separately, an effort level saved before /effort became per-model no longer applies to newly released models such as Opus 5.5. They start at their default until a level is picked. The release also refuses plugin marketplaces whose names imitate a reserved marketplace name, and stops loading any that were already added.

Why it matters: By Anthropic's own description, a write could be approved because of how its path was spelled inside the project, even when it landed outside. If you run Claude Code under acceptEdits, allow rules or auto mode, especially on repositories that can contain symlinks you did not create, upgrade. If you saved an effort level before it became per-model, check what your Opus 5.5 sessions actually run at, because that saved setting no longer reaches them.