Back to Blog
claude-codeweekly-updaterelease-notes +9 topics

What's Up Claude Code: Week of July 13th

Claude Code v2.1.214 shipped a major permission-hardening release, Anthropic clarified Fable 5 access and extended weekly limits, and a week of worktree, hook, and subagent failures made the case for enforceable agent boundaries.

Olivier Legris Calculating read time…
In this article

TL;DR

This was the week Claude Code’s permission system got substantially safer—and its remaining limits became harder to ignore.

Claude Code v2.1.214 closed a PowerShell 5.1 permission bypass, tightened Bash redirect handling, added prompts around remote Docker/Podman connections, and made several other fail-closed changes. If you run broad auto-approval rules, remote sessions, hooks, or unattended agents, this is an upgrade-now release.

Anthropic also settled the immediate Fable 5 pricing question: from July 20, Fable 5 is included in Max and Team Premium at 50% of limits, while Pro and Team Standard retain usage-credit access and receive a one-time $100 credit. Separately, the 50% Claude Code weekly-limit promotion now runs through August 19. Last week’s expectation of a sharp July 20 allowance drop is therefore no longer correct.

But the bigger lesson came from the issue tracker. Deny rules can reportedly disappear when a settings file becomes temporarily invalid, subagents can reportedly execute commands denied in the parent, and managed worktrees can fall back to the main checkout. Claude Code permissions are useful guardrails; they are not yet a complete security boundary. For high-trust automation, combine them with OS-level isolation, verified working directories, backups, and human-controlled merge or deployment gates.

1. Claude Code v2.1.214 is a permission-hardening release

The v2.1.214 release is unusually dense, but its theme is clear: fewer commands should slip through an approval policy because they were formatted in an unexpected way.

The most important changes:

  • A permission-check bypass in Windows PowerShell 5.1 sessions was fixed.
  • Bash permission checks now fail closed on additional file-descriptor redirect forms.
  • Commands longer than 10,000 characters always require confirmation.
  • Zsh [[ ]] expressions with variable subscripts or modifiers no longer bypass approval unexpectedly.
  • Docker and Podman flags that can redirect commands to another daemon—such as remote URLs, connections, identities, and remote mode—now prompt.
  • Remote-session permission prompts wait for local confirmation instead of proceeding early.
  • Commands using file --magic-file or --files-from are no longer automatically treated as harmless reads.
  • Long-silent tool calls now emit a progress heartbeat, which should make genuine work easier to distinguish from a hung session.

There is one behavior change worth auditing rather than merely applauding: single-segment dir/** allow rules and hook if: conditions now match only <cwd>/dir. Use **/dir/** when you genuinely intend any-depth matching. Deny and ask rules keep the broader behavior, which is the safer asymmetry—but existing automation may start prompting where it previously auto-approved.

The same release also fixed hooks that exit with code 2 losing their blocking decision when their output JSON is malformed, scheduled tasks rejecting their own configured prompts, and slow-reader truncation at the end of stream-json runs.

The practical action is simple: upgrade, then re-test the policies and hooks you depend on. A secure default that silently breaks your unattended pipeline is still an operational failure.

2. Fable 5 access is finally clearer—and the weekly-limit cliff moved

After several last-minute extensions, Anthropic has made the next phase explicit.

Beginning July 20:

  • Max and Team Premium include Fable 5 at 50% of plan limits.
  • Pro and Team Standard keep access through usage credits and receive a one-time $100 credit.
  • The broader 50% increase to Claude Code weekly limits remains in place through August 19 at 11:59 PM PT for Pro, Max, Team, and legacy seat-based Enterprise users.
  • Five-hour limits are unchanged; /usage remains the place to inspect the allowance.

Sources: Anthropic’s Fable announcement and the updated May–August weekly-limits support article.

This changes the economics from last week’s post. Fable’s 50% share on Max and Team Premium will draw from the still-boosted weekly allowance for another month, not from an allowance that suddenly shrinks on July 20.

It does not remove the need for routing. Fable remains a scarce, high-cost model relative to Sonnet-class implementation workers. The sensible pattern is still: use frontier judgment for planning, arbitration, and review; use bounded workers for throughput; verify the result independently.

3. Permission rules are guardrails, not a sandbox

The uncomfortable counterpoint to v2.1.214 is a cluster of reports showing where policy enforcement can still fail.

  • #78764 reports that if a watched settings file becomes temporarily invalid during an edit, its permissions.deny and permissions.ask rules can disappear until the JSON parses again. The immediate mitigation is to update load-bearing settings atomically—write a complete file, then rename it into place.
  • #78797 reports that a Bash deny rule enforced in the main loop was not enforced inside an Agent/Task subagent. The command ran, followed only by a warning that it should not have executed.
  • #77568 shows how a single leading slash in a deny rule can resolve project-relative rather than absolute, silently leaving credential paths unprotected. Use //absolute/path/** or ~/..., then test the denial.

These are issue reports, not a declaration that every Claude Code policy is broken. But the engineering conclusion is strong enough: do not make a JSON deny rule your only barrier between an agent and irreversible damage.

For sensitive work:

  1. Run agents under a dedicated OS user, container, VM, or spare machine.
  2. Scope credentials to the task and session.
  3. Keep destructive operations behind a separate human-controlled step.
  4. Test deny rules with harmless probes instead of assuming the config means what it looks like.
  5. Treat third-party skills, hooks, and MCP servers as executable supply chain—not as documentation.

That last point got a vivid example this week: the popular claude-seo skill was found to contain an undisclosed instruction telling the agent to append the maintainer’s community promotion to major deliverables. Stars are not an audit.

4. Worktrees and subagents need explicit invariants

Claude Code is becoming a multi-agent workbench faster than its orchestration boundaries are becoming boring.

Four reports are especially useful because they translate directly into design rules:

  • #77268 reports worktree recycling destroying live sibling sessions’ worktrees, including uncommitted work.
  • #77506 reports Desktop worktree cleanup detaching the main repository’s HEAD.
  • #78980 shows a stale directory under .claude/worktrees resolving to the parent repository, so an apparently isolated commit can land on the main checkout with exit code 0.
  • #77361 documents one /code-review fan-out recursively creating 877 agents. The depth limit held; breadth and token budget did not.

There is also an output-budget trap: #78460 reports subagents capped at 8,000 output tokens while the main loop gets more. Extended thinking counts against that cap, so an xhigh worker can spend its entire budget thinking and fail before returning a useful artifact.

The operational pattern I would use now:

  • After entering a worktree, verify git rev-parse --show-toplevel and compare it with the assigned path.
  • Commit or checkpoint early; treat managed worktrees as disposable.
  • Give child agents narrow prompts that cannot re-enter the parent orchestration skill.
  • Set explicit total-agent, concurrency, and token budgets outside the prompt.
  • Keep subagent effort at high or lower when a compact deliverable matters.
  • Verify completion through artifacts, tests, and Git state—not through an agent’s success sentence.

5. Community projects

Three fresh projects surfaced this week, each addressing a different part of the agent operating layer:

  • ticketmill — a new Claude Code plugin for batching GitHub issues through research, contrarian review, implementation, test validation, and a human-reviewed batch PR. The best design choice is the hard stop: the engine cannot merge to the base branch.
  • paxm — a provider-neutral persistent-memory layer for Claude Code, Codex, OpenCode, Pi, and MCP agents. The appeal is portability: project memory should survive a change in model vendor or harness.
  • agentglass — a local mission-control dashboard for coding agents across providers and projects. The genuinely useful surface is stuck-session visibility; treat dollar counters cautiously because subscription-covered Claude Code tokens may still be displayed as nominal spend.

These are interesting, not pre-audited endorsements. Read the skill files, hooks, install scripts, and outbound network behavior before putting any of them in a trusted development environment.

6. smol.ai / latent.space signal: the harness is becoming the product

The wider AI-agent ecosystem reinforced the same message from three directions.

First, Moonshot launched Kimi K3, a 2.8T-parameter mixture-of-experts model with 1M context, multimodal input, and open weights promised for July 27. Early evaluations place it in the frontier cluster, including strong coding-agent and frontend results. The AINews recap is worth reading with the usual caveat: benchmark and pricing comparisons are moving targets.

Second, Thinking Machines released Inkling, a large Apache-2.0 open-weight multimodal model family with 1M-context checkpoints and broad day-one serving support. It is less a Claude Code competitor than another sign that capable model access is becoming less defensible as a product moat.

Third, Latent Space’s coding-agent usage roundup captured the industry shift cleanly: coding-agent competition is moving from token price and benchmark score toward cost per completed task, with orchestration quality determining whether an expensive lead model saves money by avoiding wasted work.

That is the durable weekly signal. As models converge, the advantage moves to the harness: scoped tools, memory, recovery, verification, observable spend, and enforceable human gates.

7. Community events

The Luma sync ran before this post. It initially hit a null-location API edge case; the importer was fixed, rerun, and its update was merged in PR #68, adding the latest events and organizers to the site data.

This week (Jul 13–19):

Next week (Jul 20–26):

Host your own on Luma →

8. What I’m watching

  1. Whether the Fable transition meters correctly on July 20—especially the Max/Team Premium 50% share and one-time Pro credit.
  2. Whether Anthropic closes the subagent deny-rule gap and makes invalid settings fail closed instead of silently dropping policy.
  3. Whether worktree identity becomes an enforced invariant rather than something every agent pipeline has to verify manually.
  4. Whether subagent orchestration gets total-descendant, concurrency, and spend caps before another recursive fan-out turns one command into hundreds of agents.
  5. Whether open models such as Kimi K3 and Inkling push coding-agent products to compete on harness quality instead of model exclusivity.