Claude Code fixes a symlink swap that bypassed permission checks

Claude Code 2.1.251, released August 28, fixes a symlink bug in Read, Write and Edit. Anyone running the agent against one project directory is trusting that check to hold for the whole operation. It has to stay true from the first look at the path to the moment the file opens. A symlink swapped inside the working directory after the permission check passed could point those tools at a file outside the approved location.

The same release fixes Grep and Glob for a related hole. Both tools skipped Read(...) deny rules when the search path went through a symlink. A denied directory stayed searchable as long as you approached it sideways.

A third fix covers plugins. Claude Code now rejects any plugin command whose marketplace entry points outside the plugin's own directory, failing with a path-traversal error instead of running it.

Project settings lost two more escape hatches. They can no longer turn on raw API body logging or redirect beta tracing past the managed OTLP collector. Either change would have exposed request contents with no warning in the interface.

Symlink races aren't new. They've shown up in chroot escapes and setuid binaries for decades. This one surfaced in a coding agent with file access wide enough that a permission model has to exist. A race inside that model earns a dedicated fix in this release.

The release also adds PreModelSwitch and PostModelSwitch hooks and a prompt-cache line in /cost showing hit ratio and re-cached tokens, per the v2.1.251 release notes. Neither is security work. Both point at the same requirement. Every checkpoint between asking permission and doing the thing has to hold under a race. That means checking the file's real state at the moment it's used, rather than trusting an earlier check.