Claude Code 2.1.289 reportedly fixes a narrow Bash rule miss

Claude Code 2.1.289 reportedly reached npm on October 3, 2026, at 20:12 UTC with a fix for a specific Bash permission-rule case. Anthropic’s changelog reportedly describes deny and ask rules missing a command preceded by an environment-variable assignment with an expanded value when sandbox auto-allow was active.

Claude Code 2.1.289 fixes a specific Bash rule case

The reported case involves a command such as TZ="$HOME" rm -rf build. Here, an environment-variable assignment appears before the command, and its value is expanded. The reported fix applies when sandbox auto-allow is active and concerns Bash deny and ask rules.

Why the environment-variable prefix matters

The command being checked follows the assignment: TZ="$HOME" comes before rm -rf build. The reported issue was that a matching deny or ask rule could miss that command under the stated sandbox condition. Claude Code 2.1.289 is reported to fix that specific pattern.

npm tags in the October 4 observation

A reported snapshot recorded the npm tags at 23:58 UTC on October 4, 2026:

How this differs from Claude Code 2.1.288

Claude Code 2.1.288 was reported to address a separate command pattern involving a bash -c wrapper. The 2.1.289 case concerns a command preceded by an expanded environment-variable assignment when sandbox auto-allow is active.