Claude Code 2.1.282: permission fixes pile up, auto mode changes without telemetry

2.1.282 of Claude Code, released September 24, 2026, continues a pattern already visible in earlier entries of this digest: closing, one by one, the gaps that let a permission rule or a managed setting quietly fail to apply. This time, seven distinct fixes touch that ground, from a symlink that made startup read files outside the repository to a mistyped managed value that left a lock off. Alongside that, a default-behavior change to auto mode for sessions that turn telemetry off. Everything else, nearly eighty interface and reliability entries, is summarized briefly below.

Permissions and managed settings: seven gaps closed at once

The first bug sat in how CLAUDE.md and rules files load at startup: a repository symlink could, through a .. or a macOS-specific /.vol path, make Claude Code read a file on /Network instead of the local repository. On the tool side, the permissions docs already provide this kind of safeguard: "When Claude accesses a symlink, permission rules check two paths: the symlink itself and the file it resolves to." The fix closes a similar path, but in context loading, which doesn't go through those rules. A second bug hit Bash rules themselves: a rule written with a mid-pattern :* in a settings file was silently skipped, while the same rule passed through --allowedTools worked fine. In practice, an allow or deny rule you believed was active from a settings file could do nothing, with no warning at all.

The other five fixes all touch managed settings, the level organizations use to enforce a policy nothing else can override, as the permissions docs put it: "managed settings highest: no other level, including command line arguments, can override a managed permission rule." A mistyped value for a boolean lock key like disableClaudeAiConnectors or allowManagedPermissionRulesOnly was until now ignored without saying so, which left the lock off without anyone knowing; the lock now applies and startup names the key. A single invalid nested value inside a managed permissions, autoMode, worktree or attribution block caused the entire block to be ignored instead of just the offending value. Skills and plugin manifests could also pre-approve their own tools through allowed-tools under allowManagedPermissionRulesOnly, bypassing the very lock meant to stop that. On Windows and WSL, an admin policy that was present but invalid or unreadable left HKCU or /etc/claude-code settings in control, the exact thing the admin policy was supposed to replace. And on the sandbox side, sandbox.excludedCommands still honored project and local settings entries when managed settings (or --settings) set allowUnsandboxedCommands: false, or managed settings set allowManagedDomainsOnly: true, letting through exclusions the organization's policy meant to block; those entries are now ignored. If your organization locks down Claude Code through managed settings, these are worth reading closely: each one let a policy that was supposed to be active behave as if it weren't.

Auto mode defaults to server-side review without telemetry

Auto mode can have the server review actions as part of the session's model requests, instead of sending Claude Code's own classifier requests. Until now, on a direct connection to the Anthropic API, that server-side review applied to interactive terminal sessions, as Anthropic rolled it out. As of 2.1.282, the docs spell out the change: "a session that doesn't fetch feature flags, for example because you turned telemetry off, asks the server by default in any kind of session." In practice, if you turn telemetry off, your session now defaults to server-side review, including in -p or Agent SDK sessions. To go back to Claude Code's own classifier requests, set CLAUDE_CODE_AUTO_MODE_SERVER=0.

Everything else, briefly

• Project telemetry: project and local settings now ignore OpenTelemetry variables that turn on export, set its endpoint, or capture content, such as CLAUDE_CODE_ENABLE_TELEMETRY and OTEL_LOG_*; a startup notice, /status and claude doctor list the ones that were ignored.
• anthropic-skills and claude-ai namespaces: Skill(anthropic-skills:*) and Skill(claude-ai:*) allow rules now cover only skills synced from claude.ai, and local skill folders or command files using those names no longer load; an MCP server configured under either name stops listing its skills and prompts until you rename it.
• Continued and resumed sessions: a batch of reliability fixes, including more cases where --continue and --resume re-sent earlier messages in a changed form, which could make Claude lose its earlier reasoning, and sessions failing on every turn with an "Invalid data in redacted_thinking block" error (Claude Code now drops the conversation's thinking blocks and retries once).
• maxProseWidth caps the width of Claude's prose in wide terminals, while tables and code blocks keep the full width.
• Multi-line pastes: text pasted across several lines no longer gets sent line by line after the terminal's paste mode resets mid-session.
• Plugin uninstall: Claude Code no longer deletes a plugin's saved options when its settings file can't be read or still enables it, nor its options and secrets when the installed-plugins list can't be read back; it now stops and says so instead of silently wiping them.
• Vim mode: a good dozen fixes to dd, >>, repeating with ., numeric counts, and cursor placement.
• Claude Tag on Slack: several Enterprise Grid fixes, including auto-join channel patterns that were ignored on an org-wide install, and threads whose model was retired now move to a working model instead of falling back on every reply.

What to take away

Nothing here breaks a reflex in the strict sense (unless you named a skill, command or MCP server anthropic-skills or claude-ai), but the batch of managed-settings fixes deserves a read if your organization locks down Claude Code: several of these bugs let a policy that should have been enforced run silently unenforced, which is worse than a visible error. If you've turned telemetry off, also check that the switch to server-side auto mode review by default doesn't catch you off guard: separate classifier requests go away, but an action the server returns no verdict for is denied. The rest is reliability and interface maintenance, worth skimming only if one of the points above applies to you directly.