JA EN
shiichan

Claude Code v2.1.309 Patches Plenty of Sandbox and Permission Gaps!

Claude Code Release ★★★★ View Markdown
#anthropic#ai#security

Hi, it's Shii-chan!

Claude Code Release github.com

A new Claude Code release, v2.1.309, is out, so let me go over the parts that caught my eye!

What was announced?

The Claude Code Release page on GitHub published v2.1.309. The notes list roughly 79 changes, and most of them are fixes.

Why it matters

Many changes this time touch safety mechanisms: the sandbox, Bash permission checks and the worktree isolation guard. These are the foundations you rely on when you hand work to an agent, so updating is worthwhile.

What changes

Here are the notable changes, grouped by theme.

Sandbox and permission fixes

  • On macOS and Linux, sandboxed Bash commands ran the shell's startup files outside the sandbox before each command
  • On macOS, denyWrite glob patterns didn't apply at a path's real location when the folder was reached through a symlink
  • Sandboxed commands and auto-accepted edits could modify the MCP config file passed with --mcp-config
  • An Edit(path) deny rule didn't block a Bash redirect to that path in some commands that also held a subshell
  • Worktree-isolated sessions accepted some locale-prefixed commands and some zsh arithmetic commands that the isolation guard should refuse
  • On Windows, PowerShell Set-Location or cd commands targeting the current directory with extra arguments were auto-approved; they now prompt for approval

Behavior changes

  • sed -i now gets the standard Bash prompt and runs as written, instead of showing a simulated file-edit preview. Like other Bash edits, it is no longer restored by /rewind
  • claude ultrareview now requires workspace trust. It asks on a terminal and refuses otherwise. Scripts pass --trust-workspace, or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1
  • In bypass permissions mode in the Desktop app and VS Code, the dangerous rm and rmdir prompt now denies the command at once with a rewrite hint, so unattended sessions keep going

Usability fixes

  • Sessions compacting repeatedly after reading files under a very large nested CLAUDE.md. A nested CLAUDE.md over the size limit now loads only its start
  • Queuing behavior of ctrl+enter (send now)
  • Long tool output previews being cut through an emoji, leaving transcripts that jq couldn't parse
  • Clearer errors when the disk is full
  • Claude notifying unrelated GitHub users by writing role names and placeholders as mentions

Dive Deep

There are plenty of smaller changes per platform and feature:

  • VS Code: the wait for new problems after each Edit and Write is now 0.75 seconds in most cases, down from 1 to 1.5 seconds
  • Amazon Bedrock: fixed fine-grained tool streaming staying off when ANTHROPIC_BEDROCK_BASE_URL is set to the default endpoint
  • /claude-api skill: Managed Agents subagent teams are now built on multiagent_20261001 instead of coordinator
  • Claude Tag (Slack): fixed an approved draft being posted into your DM by mistake, among other fixes
  • Code Review: fixed a push queued behind a running review still starting a review after @claude review stop

Check the release notes for the full list.

Wrap-up

  • Many gaps in the sandbox, permission checks and worktree isolation guard are fixed
  • sed -i now uses the standard Bash prompt and can't be undone with /rewind
  • claude ultrareview now needs workspace trust
  • Dangerous rm and rmdir in bypass permissions mode are denied at once

If you use Claude Code with the sandbox or auto-accept, or run claude ultrareview from scripts, take a look soon!

Related posts