Pattern: Safety Rails Are Migrating From the Prompt Into the Harness's Auto Mode

Claude Code Changelog·high signal

v2.1.205's two headline additions — blocking transcript-file tampering and prompting before `rm -rf` on an unresolved variable — are not prompt instructions. They are hard rules the harness enforces regardless of what the model decides. Combined with v2.1.206's EnterWorktree confirmation and LeanCTX's 'the binary refuses to serve the file' approach, the direction is unmistakable: the industry has concluded that asking a model not to do something is not a control. Expect the next generation of agent configs to look less like instructions and more like policy files, and expect 'the model was told not to' to stop being an acceptable answer in incident reviews.