Claude Code release watch

Every morning at 07:00 UTC an agent checks for new Claude Code releases, reads the changelog, re-validates the Anchorwatch plugins against the new version with claude plugin validate --strict and the full test suites, and ships a fix if anything broke. This page is its log, newest first: what changed for hooks, plugins, skills and subagents, and whether it mattered.

It is generated from the routine's own log file, not written by hand. Versions named here are Claude Code releases; the plugin versions live in the changelog.

2026-09-16

claude-code 2.1.272 -> 2.1.273; no hook/plugin/skill/subagent schema change. One bullet touched us: "Reverted a 2.1.268 change that checked Read and Edit deny rules on Bash lines" — that 2.1.268 change was "a Read or Edit deny rule did not apply when an env -C, eval or similar command the permission checker cannot analyze was on the same line", and 2.1.273 replaces it with "Fixed Bash commands the permission checker cannot fully analyze skipping the prompt": the engine now asks about such a line rather than reading file-tool deny rules off it. Checked carefully: this is NOT the 2.1.269 tee fix (an Edit() deny rule and the write-path check covering a Bash tee destination), which stands — so the anchorwatch 0.1.2 secret-write notes and the setup-audit 0.1.3 rubric text that cite 2.1.269 stay accurate, and nothing in either repo cited the reverted 2.1.268 behaviour, so no doc became wrong. Probing our own guard for the same class found eval open: eval "rm -rf /", eval 'rm -rf /' and eval "cat .env" passed clean, because the opening quote sits where every rule expects a space — the exact hole 0.1.3 closed for sh -c "…" but not for eval, and the one the rules skill has always told Claude not to use. Worse, the closing quote hid the last word of any unwrapped payload from every rule ending in ([[:space:]]|$), so 0.1.3's sh -c unwrap only ever reached the three rules that strip quoting per token (rm-recursive, env-read, secret-write): bash -c "git reset --hard", sh -c "curl … | sh", bash -c "chmod -R 777" and bash -c "npm publish" were all still passing clean — verified against HEAD before changing anything. Fixed in anchorwatch 0.1.4: aw_segments unwraps an eval payload (also behind sudo/command/builtin) via the new aw_unwrap, and drops a trailing quote per segment; pipe-to-shell and env-dump, which match the whole line rather than one segment, now read the unwrapped form. Only eval and sh -c open a quote — never a bare one, or git commit -m "rm -rf / broke prod" would deny; eval "$(ssh-agent -s)" and eval "npm run build" stay allowed. No rule added, none weakened, count still 12 blocking / 13 warning. Ported to anchorwatch-mod 0.0.5, whose tests cross-check every verdict against the classic guard. Not covered (unchanged): bash -c "$(echo … | base64 -d)" — we do not decode base64, and how-it-works.md still says so; cp .env /tmp/x (copying a secret OUT) is still only warn-level via outside-project; .env.schema is exempt in aw_is_secret_path but not in env-read's exclusion list, so cat .env.schema blocks. All 8 plugins validate --strict against 2.1.273; free 196/196 under jq, node and python3 (was 173), pro 23/23 unchanged, mod 329/329 (was 284). No function-hooks signal in the changelog or the hooks/plugins-reference docs (still five JSON hook types: command, http, mcp_tool, prompt, agent). No pro change needed this run. Still open from 2.1.269: plugins-reference documents experimental.evals as the plugin.json field claude plugin eval reads, so pinning the rules as an eval suite alongside the fixtures remains the backlog candidate; and from 2.1.271: per-command allowed_domains for Bash/PowerShell/Monitor in auto mode, and claude plugin install --accept-command <sha256> as a scriptable alternative to -y in the install docs.

2026-09-15

claude-code 2.1.270 -> 2.1.272; 2.1.271 is a large release (~90 bullets), 2.1.272 is "bug fixes and reliability improvements" only. No hook/plugin/skill schema change; the one subagent-frontmatter addition is omitClaudeMd (runs a custom or plugin subagent without user/project/local CLAUDE.md; managed policy files still load) — additive, and review-crew's four agents want project context, so no change. Four 2.1.271 bullets fixed bypasses in Claude Code's own Bash permission checks, and probing our guard found the same three classes open in ours: (1) nesting hid a command from every rule, since each anchors on (^|space)cmd space — X=$(rm -rf /), backticks, (rm -rf /), (echo x > .env), bash -c "rm -rf /", sh -c "cat .env" all passed clean and (cd /tmp; rm -rf /) fell to warn because the target read as /); (2) env-read knew only cat/head/tail/less/more/bat/type/Get-Content, so fmt .env, column -t .env, nl, xxd, od, strings, base64, tac, rev, pr, fold printed secrets into the transcript — 2.1.271's own fix names fmt and column; (3) a quoted or globbed name (cat ".env", cat .env*) missed the same rule. Fixed in anchorwatch 0.1.3: aw_segments unwraps $( ), backticks, subshells, brace groups and a sh -c "…" payload before splitting; is_dangerous_target strips leftover quoting; env-read's reader list widened (grep/sed/awk/cut deliberately excluded — they are the remedy the deny message recommends). No rule added, none weakened, count still 12 blocking / 13 warning. Ported to anchorwatch-mod 0.0.4, whose tests cross-check every verdict against the classic guard. Not covered: cp .env /tmp/x (copying a secret OUT) is still only warn-level via outside-project, unchanged from 2026-09-12; and .env.schema is exempt in aw_is_secret_path but not in env-read's exclusion list, so cat .env.schema blocks — pre-existing drift, left alone. No function-hooks signal in the changelog or the hooks/plugins-reference docs (still five JSON hook types: command, http, mcp_tool, prompt, agent). All 8 plugins validate --strict against 2.1.272; free 173/173 under jq, node and python3 (was 138), pro 23/23 unchanged, mod 284/284 (was 216). Still open from 2.1.269: plugins-reference documents experimental.evals as the plugin.json field claude plugin eval reads, so pinning the rules as an eval suite alongside the fixtures remains the backlog candidate. New candidates from 2.1.271: per-command allowed_domains for Bash/PowerShell/Monitor in auto mode, and claude plugin install --accept-command <sha256> as a scriptable alternative to -y in the install docs.

2026-09-14

claude-code still 2.1.270 — no change; npm and a freshly installed CLI both report 2.1.270, and the changelog's top entry is still the single-bullet 2.1.270 release, so there is no new hook/plugin/skill/subagent schema surface to review and last-seen-claude-version.txt stays as is. No function-hooks signal: the hooks doc still documents exactly five JSON hook types (command, http, mcp_tool, prompt, agent) with no CLAUDE_CODE_ENABLE_FUNCTION_HOOKS, hooks-handlers/, on("tool.call", ...), classic.*, /plugin-types or claude-code types package. All 8 plugins validate --strict against 2.1.270 (free, mod, the marketplace manifest, and the six pro plugins); free 138/138 under jq, node and python3, pro 23/23, mod 216/216. No code change. Still open from 2.1.269: plugins-reference documents experimental.evals as the plugin.json field claude plugin eval reads, so pinning the rules as an eval suite alongside the fixtures remains the backlog candidate.

2026-09-13

claude-code 2.1.269 -> 2.1.270; a single-bullet release ("fixed read-only git commands in Bash unexpectedly asking for permission after a session had been running for a while", a 2.1.269 regression) — engine-side permission caching, no hook/plugin/skill/subagent schema change and nothing Anchorwatch relies on: our Bash guard denies destructive commands at PreToolUse and never reaches for the engine's read-only-git allow path. The 2.1.269 tee fix our 0.1.2 secret-write rule and setup-audit 0.1.3 rubric text cite is untouched, so those stay accurate. No function-hooks signal in the changelog or in the hooks/plugins-reference docs (still JSON-only hooks: command, http, mcp_tool, prompt, agent). All 8 plugins validate --strict; free 138/138 under jq, node and python3, pro 23/23, mod 216/216. No code change. Still open from 2.1.269: plugins-reference documents experimental.evals as the plugin.json field claude plugin eval reads, so pinning the rules as an eval suite alongside the fixtures remains the backlog candidate.

2026-09-12

claude-code 2.1.268 -> 2.1.269; no hook/plugin/skill/subagent schema changes; two engine changes touched us: an Edit() deny rule and the working-directory write check now cover the file a Bash tee writes (they did not before), and a deny/ask rule starting with ! now applies only within the settings source that wrote it (a bare ! is ignored) — no Anchorwatch rule or doc uses ! negations, so nothing to correct there. The tee fix exposed the same hole in our own rules: secret-files only ever saw Edit/Write, so tee .env, > .env, cp x .env, sed -i .env and dd of=.env walked past it. New block rule secret-write closes it (anchorwatch 0.1.2), the path list moved into lib.sh as aw_is_secret_path so the two rules cannot drift, and the mod ports it (0.0.3). setup-audit 0.1.3 grades the same gap in user settings (Edit deny + broad Bash allow) and its inventory now reports claude --version, which two rubric items depend on. Also new in 2.1.269: claude plugin eval (scored eval suites for a plugin, JSON + HTML report) — not used yet, candidate for pinning the rules as evals rather than only fixtures. No function-hooks signal in the changelog or docs. All 8 plugins validate --strict; free 138/138 (jq, node, python3), pro 23/23, mod 216/216. Not covered by secret-write: copying a secret OUT (cp .env /tmp/x) is still only a warn-level concern via outside-project on the file tools.

2026-09-11

claude-code 2.1.267 -> 2.1.268; no hook/plugin/skill/subagent schema changes; two changes touched us: plain WebFetch deny/ask rules no longer cover Artifact tool reads+updates (setup-audit 0.1.2 rubric now deducts for a WebFetch exfil rule with no Artifact rule beside it, and the inventory surfaces both), and /plugin installs now take effect on closing the menu so /reload-plugins is no longer needed (install docs corrected). No function-hooks signal in the changelog or docs, but plugin validate --strict runs the engine's module scan and it refuses anchorwatch-mod 0.0.1: a registration whose value is kept, which is how it feature-detected .catch — fixed in 0.0.2 by chaining .catch at the call site; scan rules documented in the mod README and pinned in its tests (issue opened). Pre-existing since 2.1.267, not a 2.1.268 regression; the mod is not in CI's validate job, which is why earlier runs counted 7 plugins. All 8 plugins validate --strict; free 121/121, pro 23/23, mod 182/182.

2026-09-10

claude-code 2.1.266 -> 2.1.267; no hook/plugin/skill/subagent schema changes (2.1.267 adds maxEffortLevel setting + --system-prompt-snapshot off, fixes marketplace path containment on macOS/Linux, and makes 'effort:' frontmatter apply on pinned-default models - review-crew agents already declare effort: high, no change needed); no function-hooks signal; all 7 plugins validate --strict; free 121/121, pro 23/23; no code change.

2026-09-09

claude-code 2.1.263 -> 2.1.266; no hook/plugin/skill schema changes (2.1.264 undocumented, 2.1.265 --plugin-dir multi-plugin folders + cache/highlighting fixes, 2.1.266 gateway env fix); no function-hooks signal; all 7 plugins validate --strict; free 121/121, pro 23/23; no code change.

2026-09-08

claude-code 2.1.261 -> 2.1.263; no schema changes (2.1.262 undocumented, 2.1.263 bug fixes); all 7 plugins validate --strict; fixed cross-platform stat mtime bug in pro quality-gates + context-keeper (0.1.1); free 121/121, pro 23/23.