Anthropic shipped Claude Code 2.1.281 at 17:01 UTC yesterday, less than 24 hours after 2.1.280. The changelog is one of the longest in weeks, and the item at the top of the fix list is worth committing to memory.
The delete that never triggered a prompt
A recursive delete whose target comes only from command substitution — rm -rf "$(pwd)" is the textbook case — ran unprompted in auto mode and under --dangerously-skip-permissions. Claude Code now asks even when a Bash allow rule matches. If you need the old behaviour, set CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1.
Two more fixes of the same kind. A permission rule containing a NUL byte was expanded into a wildcard, so it matched everything; it now matches nothing. And permission dialogs were reading paths under macOS special directories such as /.vol, /.nofollow and /.resolve before approval — which can reach as far as a network mount.
There’s also this: claude --bg would start a background session, project hooks and all, in a directory that had never passed the workspace trust prompt. It now asks first, or exits when it isn’t running interactively.
The gateway grows up
The second cluster is about the Claude apps gateway. Bedrock upstreams can now carry assume_role: the gateway calls Bedrock as an IAM role it assumes through STS, in another AWS account if you need that, optionally with one session per developer. Alongside it, guardrail: {id, version} applies an Amazon Bedrock guardrail to every request through that upstream — set it on all Bedrock upstreams or none.
telemetry.resource_attributes pins fixed labels onto telemetry from Claude Desktop and /login sessions. And desktop policy blocks now understand newer Desktop keys, including blockReadsOutsideWorkingDirectories and disableBypassPermissionsMode.
Small things you’ll notice
"attribution": false in settings.json hides all commit and PR attribution. One catch for shared configs: older CLI versions skip a settings file that holds this key, so keep the object form in files that travel across versions.
/insights now estimates how many permission prompts auto mode could have handled in your recent sessions. MCP servers can kick off a browser-based flow through URL-mode elicitation, without leaving a waiting dialog on screen when the server has no way to confirm completion. And claude plugin validate checks MCP too: it reports .mcp.json entries that would be silently dropped at load, undeclared ${user_config.*} references, and insecure URLs.
The rest is a release about long sessions
Count the fixes and one theme dominates: resumed sessions, and the prompt cache that broke along the way. Resumed sessions were re-sending earlier turns in a changed form, which could make the API drop the conversation’s prior reasoning. A very large session sometimes came back with only its last few messages. A session that ended during a tool call left Claude with no idea what had happened to that call. A restart in the middle of a pending permission prompt broke the cache from that point on.
Then a whole block on proxies and gateways: responses cut short but shown as complete, tool calls running twice on duplicated stream events, lost stop reasons, Content block not found when a stream event goes missing.
None of that sounds exciting. It lands exactly where the workflow Anthropic is currently advertising with Opus 5.5 lives: agents that run for hours. A session that forgets its own history when you resume it after eighteen hours makes the model underneath beside the point.