Four security fixes in one drop. PowerShell permission bypass via built-in cd functions. Git worktrees sandbox write allowlist covering the entire repo root instead of scoped paths. PowerShell prefix/wildcard allow rules incorrectly pre-approving native executables. A permission-analysis gap from stale variable tracking for PWD/OLDPWD/DIRSTACK. These are sandbox and permission-boundary issues: the kind that compound when Claude Code runs with broad access on systems adjacent to production.

Beyond the security work: /usage now shows cost broken down by category (skills, subagents, plugins, per-MCP-server) rather than a single opaque total. Useful for any workflow heavy on agent chains. /diff gains keyboard navigation (arrows, j/k, PgUp/PgDn). GFM task list checkboxes now render in markdown output. Enterprise gets allowAllClaudeAiMcps for cloud MCP connectors via managed settings.

The day opened with v2.1.148, a one-liner: Bash tool was returning exit code 127 on every command. A regression from v2.1.147. Fixed within hours of the window opening.