Claude Code 2.1.309 is a security-flavored release. The 2.1.308 release before it was a tiny fixes drop, which I covered in my 2.1.307 post.
Sandbox and permission fixes
- Sandboxed Bash commands on macOS and Linux no longer run the shell’s startup files outside the sandbox before each command.
- macOS sandbox
denyWriteglob patterns now apply at a path’s real location when the pattern’s folder is reached through a symlink. - Sandboxed commands and auto-accepted edits can no longer modify the MCP config file passed with
--mcp-config. - A disabled MCP server is no longer reconnected by a later permission prompt in print and SDK sessions.
- Several Bash permission checks were tightened, including compound commands that change directory before running git, and an
Edit(path)deny rule now blocks a Bash redirect to that path even in commands that also hold a subshell. - Worktree-isolated sessions now refuse some locale-prefixed commands and some zsh arithmetic commands the isolation guard should have caught, and worktrees ignore
git replacerefs. - Windows: PowerShell permission checks no longer auto-approve some
Set-Locationorcdcommands that carry extra arguments. - Hooks that run in PowerShell now block when the program exits with code 2.
Other fixes and improvements
- Sessions no longer compact repeatedly after reading files under a very large nested CLAUDE.md. An oversized nested file now loads only its start.
- Split-pane agent teammates now inherit the tool deny and
--toolsrules given on the leader’s command line. - Fixed tool output previews cutting through an emoji and leaving transcripts that jq couldn’t parse.
- macOS: the “Install Command Line Developer Tools” dialog no longer opens at every start on a Mac without Xcode.
- Faster git commands on Windows, and clearer disk-full messages naming the folder to free up.
My take
If you rely on the sandbox or deny rules, this is one to update to soon. The fix for shell startup files running outside the sandbox is the headline, since that’s exactly the kind of gap that makes a sandbox less useful than it looks.
Have a blessed day! And Happy Hacking!
