Claude Code 2.1.269 closes a `!` negation escape and a `tee` write bypass.

A deny or ask rule starting with ! was applying beyond the settings source that wrote it; it's now scoped to its own source, and a bare ! negation is ignored. Separately, Edit() deny rules and the write-path check now apply to the file a Bash tee writes, so a Bash(tee:*) allow no longer covers destinations outside the working directories (changelog). Anyone who wrote a careful deny list should re-read it, because the scope those rules had last week isn't the scope they have now.