Claude Code 2.1.289: deny rules catch symlinks & env-prefixed Bash; agent.spawn
Claude Code 2.1.289 (Oct 3) closes permission gaps: Read deny rules resolve symlinks, Bash deny/ask rules catch env-prefixed and bare-assignment compounds under sandbox auto-allow, and managed deny/ask on nested shell parts hold over user-mod approvals. Plugins get an agent.spawn hook plus idle/waiting states in $.agent.list().
