Claude Code Closes Bash, Sed, Worktree Sandbox and Monitor Permission Gaps in 2.1.319

Claude CodeNov 6, 2026View original changelog

Claude Code 2.1.319 fixes a Bash permission bypass, a sed permission-check skip, a sandbox escape when creating a worktree, missed Bash deny and ask rules, and a /rewind symlink case. It also tightens Monitor, ask-versus-deny precedence, which, --add-dir marketplaces and nested skill loading. All of these concern what the agent could do outside what the user authorized.

Key Takeaways

A crafted environment prefix could hide part of a Bash command from permission checks, and 2.1.319 fixes it.
A sed command could skip the permission check in accept-edits and auto mode.
A sandbox escape when creating a worktree is patched.
Broader deny rules now beat exact ask rules for Bash and PowerShell, so the command is refused rather than asked about.
Monitor's WebSocket watch now obeys Bash rules, and an allow on Monitor no longer skips an ask prompt.
--add-dir marketplaces and nested skills are gated behind trust, so adding a folder no longer implies trusting what it contains.

Fixes Where the Agent Could Act Outside Authorization

Claude Code 2.1.319 patches several gaps in the permission and sandbox boundary.

A Bash permission bypass: a crafted environment prefix could hide part of a command from permission checks. The release notes do not give more detail.
A sed command could skip the permission check in accept-edits and auto mode.
A sandbox escape when creating a worktree.
Bash deny and ask rules missed commands written with quoted words.
/rewind could restore or delete a file through a directory symlink.
With --trust-workspace false, self-hosted runners now also stop hooks in the repository's settings files and skills from running.

Tightened Behavior

Monitor's WebSocket watch now follows a rule on every Bash command. A deny refuses it, and under an ask rule an allow on Monitor, bypass mode or auto mode no longer skips the prompt.
A session's exact Bash or PowerShell ask rule is now refused, not asked about, when a broader deny rule covers the command.
The Bash tool now asks before running which with flags outside a lookup/display set.
--add-dir directories register plugin marketplaces only after that directory's own trust dialog is accepted.
With the Bash sandbox on, skills in .claude/skills folders below the starting folder load only if Claude Code is started there or the user runs /cd there.
CLAUDE_CODE_PROXY_RESOLVES_HOSTS can no longer be set from settings files where the host manages the network.

Reading the Cluster

The common thread is that approval prompts and sandbox limits are meant to bound the agent, and each item above is a path around them. Users on 2.1.318 or earlier who rely on deny rules, the sandbox or worktrees should update.