Claude Code Closes Sandbox, Bash Permission and Worktree Isolation Gaps in 2.1.309

Sandbox gaps closed

Claude Code 2.1.309 patches a group of cases where the sandbox did not contain what it was meant to contain. The most notable one affects macOS and Linux: sandboxed Bash commands ran the shell's startup files outside the sandbox before each command. That meant code in a user's shell profile executed without the sandbox's restrictions on every command Claude ran. The release moves that step inside the sandbox.

Two further holes concerned writes the sandbox should have refused. On macOS, denyWrite glob patterns did not apply at a path's real location when the pattern's folder was reached through a symlink, so a symlinked route could slip past the rule. Sandboxed commands and auto-accepted edits could also modify the MCP config file passed with --mcp-config, which is a file that controls which tool servers a session trusts. On Linux, sandbox write denies were lifted when a background command outlived the session. All of these now behave as the rules say.

A related protection also had a symlink hole: profile store write protection did not apply when the config directory was reached through a symlink. Claude Code 2.1.309 closes that too. In print and SDK sessions, a disabled MCP server could be reconnected by a later permission prompt, and that no longer happens.

Bash permission checks that now prompt

Several Bash permission checks were too trusting. The check no longer trusts a variable set by a command whose redirect can fail to open. Compound commands that change directory before running git now prompt even when the cd is wrapped or prefixed, matching the behavior for a plain cd. An Edit(path) deny rule now blocks a Bash redirect to that path in commands that also contain a subshell, a case that previously got through.

On Windows, PowerShell permission checks no longer auto-approve some Set-Location or cd commands that target the current directory and carry extra arguments. These commands now ask for approval.

Worktree isolation

Worktree-isolated sessions are meant to keep Claude away from the main checkout. Two guard gaps are fixed: sessions accepted some locale-prefixed commands the isolation guard should have refused, and sessions on zsh accepted some arithmetic commands the guard should have refused. Worktrees and branch checkouts that Claude Code creates now also ignore git replace refs, as its other git operations already did. Separately, worktree creation and reuse no longer let git fetch objects on demand, in ordinary clones and in partial clones with a Bash sandbox configured. A partial clone now fetches them first.

Hooks, bypass mode and sandbox fallback

Hooks that run in PowerShell did not block when the hook program exited with code 2. On Windows, PreToolUse and PermissionRequest hooks with "shell": "powershell" also failed open when Git for Windows was not installed. Both cases now block as intended, which matters because a hook that fails open silently removes the guardrail it was written to provide.

The release also changes two behaviors. In bypass permissions mode in the Desktop app and VS Code, the dangerous rm and rmdir prompt now denies the command at once with a rewrite hint, so unattended sessions keep going instead of stalling on a prompt. And commands that settings exclude from the sandbox now ask before writing to the sandbox's write-list paths while the sandbox is enabled but cannot run. The unsandboxed fallback is refused there.

Split-pane agent teammates also now inherit the tool deny and --tools rules given on the leader's command line, so a teammate can no longer use tools the leader was told not to.