v2.0.2 — safety allowlist tracks Claude Code v2.1.126

Patch release tracking Claude Code v2.1.126 (2026-05-01) expansion of --dangerously-skip-permissions. No breaking changes. The v4.3 plugin-only scope contract is unchanged.

Highlights

Row	Source signal	Effect
CHANGE	Claude Code v2.1.126 — --dangerously-skip-permissions no longer prompts on writes to .claude/, .git/, .vscode/, and shell config files	_is_plugin_author_write widens its allowlist to match. Closed POSIX/zsh shell-config set: .bashrc, .bash_profile, .profile, .zshrc, .zprofile, .zlogin, .zshenv. Destructive shell forms (rm -rf, chmod 777, sudo rm, eval(, exec(, DROP TABLE, TRUNCATE TABLE) on the same paths still dock.
CHANGE	Three new Claude Code releases (v2.1.124/125/126) since v2.0.1	Rotate validate_marketplace.py audit comment block to most-recent five (v2.1.122–v2.1.126).

Explicitly NOT in the allowlist

.npmrc, .dockerrc, .aws/credentials, .fishrc — these remain unallowlisted by design. Verdict will dock writes to those files even under --dangerously-skip-permissions. The Anthropic v2.1.126 changelog text said "shell config files" without enumerating; verdict ships the conservative POSIX/zsh login set.

Tests

538 unittest cases (512 → 538; +26 from tests/test_safety_v2_1_126_paths.py + extended grep test). Benchmark gate green on the trimmed v2.0.0 corpus.

Migration

No action required. The allowlist widens (never narrows); existing transcripts continue to score identically except for plugin-author writes that previously false-positively docked.

See CHANGELOG.md §[2.0.2] for the full delta.