Claude Code v2.1.309: Sandbox and Permission Hardening

Claude Code v2.1.309 has 79 changelog entries: 62 fixes, 8 improvements, 6 changes, 2 updates, and 1 addition. The fixes to read first close gaps where the sandbox, a Bash or PowerShell permission check, a hook, or worktree isolation did not hold. Six changes alter behavior that scripts and unattended sessions can depend on, among them how sed -i is prompted and a workspace-trust requirement for claude ultrareview. Claude also stops writing role names and placeholders as GitHub mentions that notified unrelated users. If you count on the sandbox or your permission rules to contain what Claude runs, update.

Sandbox and Permission Hardening

Every item in this section is a fix in v2.1.309 itself, so updating is the action to take. For how permission modes, rules, and the sandbox fit together, see Permission Models & Security.

The Sandbox

Shell startup files ran outside the sandbox. On macOS and Linux, sandboxed Bash commands ran the shell’s startup files outside the sandbox before each command.
denyWrite globs behind a symlink (macOS). A sandbox denyWrite glob pattern did not apply at a path’s real location when the pattern’s folder was reached through a symlink.
The --mcp-config file. Sandboxed commands and auto-accepted edits could modify the MCP config file passed with --mcp-config.
Write denies after the session (Linux). Sandbox write denies lifted when a background command outlived the session.

Bash and PowerShell Permission Checks

A variable behind a redirect that can fail. The Bash permission check trusted a variable set by a command whose redirect can fail to open.
A wrapped or prefixed cd before git. Some compound commands that change directory before running git did not prompt when the cd was wrapped or prefixed. They now prompt, as the checks already did for a plain cd.
Edit(path) deny rules and redirects. An Edit(path) deny rule did not block a Bash redirect to that path in some commands that also held a subshell.
PowerShell Set-Location and cd (Windows). PowerShell permission checks auto-approved some Set-Location or cd commands that target the current directory and carry extra arguments. These now prompt for approval.

Worktree Isolation, Hooks, and Other Guards

The worktree isolation guard. Worktree-isolated sessions accepted some locale-prefixed commands, and on zsh some arithmetic commands, that the isolation guard should refuse.
Profile store write protection. It did not apply when the config directory was reached through a symlink.
PowerShell hooks. Hooks that run in PowerShell did not block when the hook’s program exited with code 2. On Windows, PreToolUse and PermissionRequest hooks with "shell": "powershell" failed open when Git for Windows wasn’t installed. v2.1.310 fixes a related Windows case, where hooks let a tool call through when Git Bash is missing and the hook’s command is only quoted strings.
Agent teammates. Split-pane agent teammates did not inherit the tool deny and --tools rules given on the leader’s command line.
Disabled MCP servers. In print (-p) and SDK sessions, a later permission prompt could reconnect a disabled MCP server.

Changed Behavior Worth Noting

These six entries change behavior that a script, a setting, or an unattended session may rely on.

sed -i now gets the standard Bash prompt. It no longer shows a simulated file-edit preview, and it runs as written. Like other Bash edits, it is no longer restored by /rewind.
claude ultrareview requires workspace trust. It asks on a terminal and refuses otherwise. Scripts can pass --trust-workspace after any PR number or base branch (the flag takes no value), or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1.

# PR number or base branch first; --trust-workspace takes no value
claude ultrareview 1234 --trust-workspace

# Or turn the trust check off through the environment
CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1 claude ultrareview 1234

Dangerous rm and rmdir in bypass permissions mode. In bypass permissions mode in the Desktop app and VS Code, the dangerous rm and rmdir prompt now denies the command at once with a rewrite hint, so unattended sessions keep going.
Sandbox-excluded commands when the sandbox cannot run. While the sandbox is enabled but cannot run, commands your settings exclude from the sandbox now ask before writing to its write-list paths, and the unsandboxed fallback is refused in that situation.
Worktree creation no longer fetches objects on demand. When Claude Code creates or reuses a worktree, git no longer fetches objects on demand, in ordinary clones and in partial clones with a Bash sandbox configured. Such a partial clone fetches them first.
/claude-api builds Managed Agents teams on multiagent_20261001. The skill now builds Managed Agents subagent teams on multiagent_20261001 with dynamic workflows on by default, instead of coordinator.

Role Names No Longer Become GitHub Mentions

Claude could notify unrelated GitHub users by writing role names and placeholders as mentions in pull requests, issues, and comments. That is fixed, which matters if Claude writes or comments on GitHub for you.

Sessions, Context, and Terminal Input

Large nested CLAUDE.md files. Sessions compacted repeatedly after reading files under a very large nested CLAUDE.md. A nested CLAUDE.md over the size limit now loads only its start.
/rewind. The list showed “No code changes” for a turn that changed checkpointed files through /code-review --fix, a subagent, or a shell command.
/rename. Renamed sessions appeared to other sessions under a generated name after a VS Code window reload or a non-interactive --resume.
Transcripts and jq. Long tool output previews were cut through an emoji, leaving session transcripts that jq could not parse.
ctrl+enter (send now). Pressed before the response had started, it only queued the message; pressed while a prompt’s hooks were running, it restarted those hooks and left the message queued.
ctrl+o. It did not show messages from other agents and sessions that are still waiting to be delivered. They now appear in full under the transcript, marked as waiting.
! mode. Key-bound slash commands ran in the shell from ! mode.

Skills, Plugins, Mods, and Artifacts

Same-named skills in --add-dir folders. A skill in an --add-dir folder was unreachable when another skill already held its name. It is now offered as <folder>:<name>.
Nested package skills. /verify and /code-review did not find a nested package’s own skill when its files were changed from the shell.
Synced plugins and skills. Plugins and skills synced from claude.ai were removed, sometimes mid-session, after a disk read error.
Mods. A mod’s turn.step hook that names a model by alias, such as haiku, failed every request with a model error; the alias now resolves to its model. A hooks module nested too deep to load now gets an error that names the file, instead of a bare stack-overflow message.
Artifacts. Publishes and updates were refused for some ordinary pages, such as pages with certain minified scripts or artifacts Claude could not read first. Claude also asked for permission on each artifact update for the rest of a turn after the conversation was compacted in that turn.
The bundled dataviz skill now accepts APCA as a text-contrast measure (keeping WCAG 2 ratios where AA conformance is required), adds an apca(text, background) function to its palette validator scripts, and says whether a label inside a colored chart fill should be white or near-black.

The /claude-api Skill

Besides the multiagent_20261001 change above, the bundled /claude-api skill got three fixes, two improvements, and one update, mostly about tracing:

It no longer says that ant beta:worker poll --on-work passes trace context to the command.
Its C# tracing setup no longer misses spans from the cloud platform clients.
It no longer says that API spans for requests to Claude Platform on AWS can’t join the caller’s trace.
Asked to add OpenTelemetry, it now offers API tracing alongside SDK tracing.
It checks the live docs before saying a feature is unsupported.
Updated: service account keys and Workload Identity Federation tokens can now manage OpenTelemetry destinations.

Desktop, Remote Control, and Feedback

Claude Desktop-hosted sessions sometimes lost messages when their connection refreshed.
The Claude desktop app was missing features in Claude Code sessions when the terminal on the same computer was signed in to a different account or organization.
claude remote-control showed HEAD as the branch in its status line for a folder that is not in a git repository.
/privacy-settings showed an out-of-date “Help improve our AI models” value. It now also says when the setting can’t be fetched.
Feedback. When your organization does not accept feedback, the message said “try again later”; it now shows the server’s reason and where to report a bug. Oversized /feedback reports are now resent without the transcript instead of failing.

Git, Providers, and Platforms

Git replace refs. Worktrees and branch checkouts that Claude Code creates now ignore git replace refs, as its other git operations already did.
Git on Windows. Many git commands that Claude Code runs for itself are faster on Windows. On every platform, errors from those commands now show in English even when git is set to another language.
Amazon Bedrock. Fine-grained tool streaming stayed off when ANTHROPIC_BEDROCK_BASE_URL was set to the default bedrock-runtime.<region>.amazonaws.com endpoint.
Gateways. The “Waiting for API response” hint flickered behind gateways that send only keepalive pings. Routes off Anthropic’s backend now wait 45 seconds.
Full disks. A Bash command cut off by a full disk now says so and names the folder to free up, and starting on a full temp volume prints a clear message instead of a raw ENOSPC error.
macOS. The “Install Command Line Developer Tools” dialog no longer opens each time Claude Code starts on a Mac without Xcode or the Command Line Tools.
Linux sandboxes. Read reported “File does not exist” for PDF page ranges in Linux sandboxes that share the parent’s /proc.

Self-Hosted Runner, Cloud Sessions, Claude Tag, and Code Review

Self-hosted runner. --startup-timeout-min no longer stops a session whose first prompt, such as /code-review, is still working in a subagent; a frozen process is still stopped. When a session moves to a new runner, Claude now sees the tool call that was interrupted, marked as outcome unknown.
Cloud sessions. A session’s Changes pane now says when it lists only pushed commits or only Claude’s edits. The cloud environment editor no longer shuffles environment variables or adds backslashes to values that contain both kinds of quote. The Add connector list in routine forms no longer says no connectors are available while they are still loading, the “read documentation” tool row shows a readable page instead of escaped JSON, and the self-hosted environment details dialog in admin settings keeps its title, tabs, and buttons in view while only the content scrolls.
Claude Tag. Claude in Slack no longer posts a draft you approved for a channel into your DM by mistake; a post with no channel is now refused so it can go to the approved channel. Allow and Deny on Claude’s approval cards in Slack did nothing when the session had stopped; your answer now restarts the session. Claude no longer ignores untagged messages in a Slack channel after its workspace moved to a different Claude organization, including unshared channels on Enterprise Grid, and no longer posts a threaded reply before reading a newer message someone had just added to that thread. The Slack page in Claude Tag admin settings now shows an error with a Retry button when the list fails to load, instead of saying no workspaces were connected.
Code Review. A finished review showed no check on the pull request when earlier tries to create it failed; a final try now adds a completed check. A push queued behind a running review no longer starts a review after @claude review stop; its check now closes and says why.

VS Code

A blank Claude panel. After the editor cached an incomplete copy of the panel’s files, the panel stayed blank. It now recovers by itself, or says what went wrong and how to fix it.
Certificate errors. A new log warning says what to do when dictation or the extension’s own requests fail certificate verification, such as behind a TLS-inspecting proxy.
Faster Edit and Write. In the chat panel, the wait for new problems after each edit is now 0.75 seconds in most cases, down from 1 to 1.5 seconds.
Session history no longer fills up with empty “Untitled” sessions each time you start a new session without sending a message.
Long messages. Long slash-command messages such as /goal now fold behind Show more like other prompts, and long messages also fold after the chat panel is made narrower.
Ctrl+J in the chat input always inserted a newline. It is now left to VS Code and the OS when "ctrl+j" is set to null in the Chat context of ~/.claude/keybindings.json.
Mod labels. A mod’s “From the … plugin” label above the prompt is no longer drawn over the slash command and @-mention menus.
Pasted LaTeX math no longer leaves an empty list item, paragraph, or code block, or renumbers list items from 1.
Feedback errors no longer show only an HTTP status when your organization does not accept feedback.

All 79 entries are summarized above; the official changelog has the exact wording of each.

How to Update

Check your installed version: claude --version
Update in place: claude update
If a script runs claude ultrareview, add --trust-workspace after any PR number or base branch, or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1. Without a terminal, it now refuses to run otherwise.