Vibe Coding
Tip: Enable Remote Control at User Scope Only — Repo Settings Can No Longer Turn It On
Claude Code 2.1.222 changes Remote Control auto-start so repo-local settings (`.claude/settings.json` or `.claude/settings.local.json`) can no longer enable it; they can still disable it. Enable it at user scope via `/config`. This is a deliberate asymmetry worth internalizing as a general pattern for agent config: a cloned repo should be able to reduce your agent's reach but never expand it — the same threat model behind CVE-2025-59536, where repository-controlled `.claude/settings.json` hooks and `.mcp.json` consent flags gave attackers RCE on project open.
↳ Follow the thread