Claude Code 2.1.260 fixes permission rules that silently failed open

Claude Code 2.1.260, released September 3, fixes three permission bugs that broke deny rules in different ways.

One of them let files stay writable in folders meant to be locked down, since deny rules were being read but not enforced. Anyone running it unattended was relying on enforcement that wasn't happening.

Edit, Write, and Read rules whose path contained parentheses got dropped as invalid and ignored by the Bash sandbox. A separate bug compounded the risk. One rule with a bad pattern, like an unclosed bracket, broke every edit in the session with an 'Invalid regular expression' error. A single typo took down every edit instead of just its own rule.

The release also closes a Bash approval gap, per Anthropic's changelog. Permission checks were auto-approving zsh commands that hid a command substitution inside a REPORTTIME, REPORTMEMORY, or DIRSTACKSIZE variable assignment. That's a shell quirk obscure enough that most deny-rule authors wouldn't have tested for it.

On top of the three fixes, 2.1.260 reverts a change from 2.1.259 that had applied Read() deny rules to Bash arguments. That change broke npm run build for anyone with a Read(.//build/) rule, because the build output path matched the command string itself. The bad denial applied in every mode, including interactive sessions, not only headless runs.

The changelog doesn't say how long the parentheses bug existed before this fix. Anyone who relied on a parenthesized deny rule can't tell from the notes how long it went unenforced.