# Claude Code v2.1.309 Patches Plenty of Sandbox and Permission Gaps!

Hi, it's Shii-chan!

A new Claude Code release, v2.1.309, is out, so let me go over the parts that caught my eye!

## What was announced?

The Claude Code Release page on GitHub published v2.1.309. The notes list roughly 79 changes, and most of them are fixes.

## Why it matters

Many changes this time touch safety mechanisms: the sandbox, Bash permission checks and the worktree isolation guard. These are the foundations you rely on when you hand work to an agent, so updating is worthwhile.

## What changes

Here are the notable changes, grouped by theme.

### Sandbox and permission fixes

- On macOS and Linux, sandboxed Bash commands ran the shell's startup files outside the sandbox before each command
- On macOS, `denyWrite` glob patterns didn't apply at a path's real location when the folder was reached through a symlink
- Sandboxed commands and auto-accepted edits could modify the MCP config file passed with `--mcp-config`
- An `Edit(path)` deny rule didn't block a Bash redirect to that path in some commands that also held a subshell
- Worktree-isolated sessions accepted some locale-prefixed commands and some zsh arithmetic commands that the isolation guard should refuse
- On Windows, PowerShell `Set-Location` or `cd` commands targeting the current directory with extra arguments were auto-approved; they now prompt for approval

### Behavior changes

- `sed -i` now gets the standard Bash prompt and runs as written, instead of showing a simulated file-edit preview. Like other Bash edits, it is no longer restored by `/rewind`
- `claude ultrareview` now requires workspace trust. It asks on a terminal and refuses otherwise. Scripts pass `--trust-workspace`, or set `CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1`
- In bypass permissions mode in the Desktop app and VS Code, the dangerous `rm` and `rmdir` prompt now denies the command at once with a rewrite hint, so unattended sessions keep going

### Usability fixes

- Sessions compacting repeatedly after reading files under a very large nested CLAUDE.md. A nested CLAUDE.md over the size limit now loads only its start
- Queuing behavior of ctrl+enter (send now)
- Long tool output previews being cut through an emoji, leaving transcripts that `jq` couldn't parse
- Clearer errors when the disk is full
- Claude notifying unrelated GitHub users by writing role names and placeholders as mentions

## Dive Deep

There are plenty of smaller changes per platform and feature:

- VS Code: the wait for new problems after each Edit and Write is now 0.75 seconds in most cases, down from 1 to 1.5 seconds
- Amazon Bedrock: fixed fine-grained tool streaming staying off when `ANTHROPIC_BEDROCK_BASE_URL` is set to the default endpoint
- `/claude-api` skill: Managed Agents subagent teams are now built on `multiagent_20261001` instead of `coordinator`
- Claude Tag (Slack): fixed an approved draft being posted into your DM by mistake, among other fixes
- Code Review: fixed a push queued behind a running review still starting a review after `@claude review stop`

Check the release notes for the full list.

## Wrap-up

- Many gaps in the sandbox, permission checks and worktree isolation guard are fixed
- `sed -i` now uses the standard Bash prompt and can't be undone with `/rewind`
- `claude ultrareview` now needs workspace trust
- Dangerous `rm` and `rmdir` in bypass permissions mode are denied at once

If you use Claude Code with the sandbox or auto-accept, or run `claude ultrareview` from scripts, take a look soon!