What's changed Fixed single-segment `dir/` allow rules like `Edit(src/)` auto-approving writes to nested `dir/` directories anywhere in the tree instead of only `/dir` Fixed a permission-check bypass affecting commands run in Windows PowerShell 5.1 sessions Fixed Bash permission checks to fail closed on file-descriptor redirect forms that bash parses differently than the permission analyzer Fixed Bash permission checks misjudging very long commands — commands over 10,000 characters now always prompt instead of running automatically Fixed Bash permission checks treating zsh variable subscripts and modifiers in `[[ ]]` comparisons as inert text — these commands now prompt for approval Fixed Bash permission checks to no longer auto-approve certain `help` and `man` commands that could run unsafe options, command substitutions, or backslash paths Fixed permission prompts on remote sessions that could proceed before the local confirmation dialog Added the EndConversation tool: Claude can end sessions with highly abusive users or jailbreak attempts, as on claude.ai since 2025 — see https://www.anthropic.com/research/end-subset-conversations Added a periodic progress heartbeat for…