claude ultrareview now requires workspace trust

Claude Code 2.1.309, released October 22, changes claude ultrareview to require workspace trust. On a terminal it asks. Anywhere else it refuses. See the Claude Code sheet for the rest of the CLI surface.

What changed

The subcommand runs a cloud ultrareview non-interactively and prints the findings to stdout. Before 2.1.309 it did not check whether the current folder was trusted. Now it asks:

Trust <folder>? [y/N]

Answer y only if you trust the folder's code. The docs warn that git and Claude Code can then run programs named in its git configuration and project settings.

When the subcommand cannot ask, such as in a CI job or with output sent to a file, it exits with Error: Workspace not trusted. Answering n, pressing Enter, or pressing Ctrl-C at the question also exits 1.

Fixing a CI job

Append --trust-workspace. It trusts the current folder for that run only and takes no value. Put the PR number or base branch before it:

claude ultrareview 1234 --trust-workspace

The flag requires Claude Code 2.1.309 or later.

The changelog also lists an escape hatch: set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1 to skip the check. That turns off the protection for every run in that environment, so prefer the flag.

Reviewing an untrusted pull request

The docs suggest running the command from a branch you trust:

claude ultrareview <PR number> --trust-workspace

In PR mode the pull request is cloned in the cloud, so its branch does not need to exist locally. Nothing from your working tree is uploaded.

What did not change

Exit codes stay the same: 0 when the review completes, 1 on failure, and 130 on Ctrl-C while launching or waiting. An untrusted folder counts as a failure and exits 1.