Claude Code 2.1.288 bypassed deny and ask rules via env-var prefix

In Claude Code 2.1.288, TZ="$HOME" rm -rf build ran in 6 of 6 attempts despite a Bash(rm *) deny or ask rule with the Bash sandbox in auto-allow mode. Version 2.1.289 fixed both bugs, blocking all 6 runs, but bash -c 'rm -rf build' still runs.

• 2.1.288: TZ="$HOME" rm -rf build ran 6 of 6 times despite Bash(rm *) deny rule
• 2.1.289: the same command was blocked 6 of 6 times
• bash -c 'rm -rf build' still runs 6 of 6 times on 2.1.289
• FOO="$(pwd)" rm -rf build ran 7 of 7 times when Bash was allowed