Claude Code v2.1.309 Update: Sandbox Security Fixes and Bash Permission Improvements

Claude Code has released v2.1.309, a maintenance update centered on security hardening and Bash permission logic fixes. The changelog covers macOS/Linux sandboxing, MCP config protection, worktree isolation, desktop, and the VS Code extension, with most of the entries pointing to a single class of issues: sandbox boundaries and permission confirmations can be bypassed or misjudged in edge cases.

Sandbox Security: Closing Gaps Around Startup Files and Symlinks

The most notable fixes in this update are sandbox-related. Sandboxed Bash commands on macOS and Linux previously ran the shell's startup files before each command executed, and those startup files ran outside the sandbox—effectively opening a side door into the sandbox. v2.1.309 fixes this by bringing startup file execution under sandbox constraints as well.

Another typical vulnerability involves symlinks: when a path targeted by a denyWrite glob pattern is reached via a symlink, the pattern does not take effect at the path's real location. Similarly, write protection for the profile store does not apply when the config directory is reached via a symlink. The common thread here is trusting the surface form of a path rather than its resolved real location; after the fix, write protection now covers symlink scenarios.

MCP Config and Worktree Isolation

Sandboxed commands and auto-accepted edits could previously modify the MCP config file passed via --mcp-config; this gap has been closed. On the worktree isolation front, commands with locale prefixes and some arithmetic commands in zsh were previously let through by the isolation guard; they are now correctly rejected. Additionally, worktrees and branch checkouts created by Claude Code now ignore git replace refs, consistent with other git operations.

Shell startup files are the initialization scripts that bash reads in a fixed order on startup, whether interactive or not—for example /etc/profile, ~/.bash_profile, ~/.bashrc, ~/.profile, and the like (for zsh, .zshenv and .zshrc). These files can define aliases, functions, PATH, and environment variables, so once executed outside the sandbox, any command within them runs with unrestricted privileges—equivalent to giving the sandboxed command an escape hatch. Bringing startup file reads under sandbox constraints means the sandbox policy must apply to the shell's initialization phase before the command actually executes, not just wrap the final argv.

denyWrite is a set of glob patterns in Claude Code's permission configuration used to declare "paths that must not be written," typically paired with rules like allowWrite to form a whitelist/blacklist of the filesystem write surface. Symlink bypasses work because matching happens at the path string level: /proj/link/file and the /etc/secret/file it actually points to differ textually, but if only the former is compared, it is mistakenly judged as allowed. The correct approach is to resolve with realpath (or compare by inode) first, then apply the rules to the resolved result.

MCP (Model Context Protocol) is a protocol that lets clients like Claude Code connect to external tools and data sources in a standard way. Servers can be local processes or remote HTTP services; the config file passed via --mcp-config describes which servers to connect to, how to start them (command or URL), and the credentials and environment variables to pass to them. Because this file may carry tokens and launch commands, it is itself a high-value target: if rewritten by a sandboxed command or an auto-accepted edit, an attacker could silently redirect Claude's connections to a malicious server or inject launch parameters with side effects. Removing this file from the writable set is a classic case of "protecting the control plane, not just the data plane."

git worktree allows multiple working directories to be checked out simultaneously from the same repository, each corresponding to a different branch, commonly used for parallel development and isolated experiments. Claude Code's isolation guard relies on parsing commands to determine whether a command will escape the current worktree, but syntax with locale prefixes (e.g., LC_ALL=C) or zsh arithmetic (e.g., (( i++ ))) can interfere with naive parsing logic and be misjudged as harmless. git replace refs are a set of refs/replace/* references that let git substitute an alternative object for the original when reading objects; if used in worktree and branch checkouts, the checked-out content would not match the actual history, so they need to be explicitly ignored just like other git operations.

Bash Permission Checks: From Compound Commands to Redirection

The permission system fixed a number of cases this time that "look harmless but actually change the execution context." For compound commands that change directory and then run git, when cd is wrapped or prefixed, a permission prompt was previously not triggered; this now aligns with normal cd behavior. Bash permission checks also fixed an issue where variables set by a command were trusted even though that command's redirection might fail to open.

One notable detail is the Edit(path) deny rule: in some commands that also hold a subshell, the rule could not prevent Bash redirection to that path; this has been fixed. On Windows, PowerShell permission checks were corrected for certain Set-Location or cd commands that were auto-allowed—when these commands point to the current directory and carry extra arguments, approval is now required.

Compound commands and redirection are the two syntax categories most prone to missed detection in permission checks. Compound commands refer to joining multiple commands into one unit using &&, ||, ;, pipes, subshells ( ... ), command substitution $( ... ), etc. If the permission system only checks the first token of the entire string, it will miss sensitive operations like cd and git within it; cd x && git ... is especially dangerous because it changes the working directory for subsequent commands, thereby changing what relative paths point to. Redirection (>, >>, 2>, &>) bypasses normal interception by the Edit/Write tools—the write happens through the shell rather than the editor, so tool-scoped deny rules like Edit(path) inherently cannot cover it. The key to the fix is that permission decisions must be based on the parsed command structure (an AST or a sequence of subcommands split by delimiters), and redirection targets must be checked separately against path rules as a write operation.

Interaction and Session Stability

Fixes at the everyday usage level are equally dense. ctrl+enter (send immediately) previously only queued a message if pressed before the response began; pressing it during hooks would restart hooks but leave the message in the queue. Behavior is now unified. ctrl+o now fully displays messages from other agents and sessions that are still awaiting delivery, and marks them as pending in the transcript.

The /rewind list previously showed "No code changes" for turns where the checkpoint file was modified via /code-review --fix, a subagent, or a shell command; this false report has been corrected. Issues where a renamed session appeared under a generated name in other sessions, and where Claude Desktop managed sessions lost messages on connection refresh, have also been addressed.

Large Files and Disk Anomalies

The issue where sessions repeatedly compacted after reading an extremely large nested CLAUDE.md has been fixed; nested CLAUDE.md files exceeding the size limit now load only the beginning. Disk-full handling is friendlier too: Bash commands interrupted by a full disk now clearly explain the situation and point to folders that can be cleaned up, and starting on a full temp volume prints a clear message instead of a raw ENOSPC error.

VS Code and Cloud Sessions

The VS Code extension fixed an issue where the Claude panel went blank after the editor cached an incomplete file; it can now recover on its own or provide repair guidance. Issues with empty "Untitled" sessions piling up, long slash-command messages being collapsed, and LaTeX math formulas being pasted with corrupted formatting have also been handled. Edit and Write are faster in the chat panel, with the wait for new issues after each edit dropping from 1–1.5 seconds to 0.75 seconds in most cases.

On the cloud session side, fixes address the connector list falsely reporting no available connectors while loading, and the environment variable editor scrambling order and adding backslashes to values containing two kinds of quotes. Several Claude Tag behaviors in Slack were also corrected, including approval drafts being mistakenly sent to DMs, approval card buttons becoming unresponsive after a session stops, and unmarked messages being ignored after a workspace migrates to another organization.

Skills and Toolchain Adjustments

The /claude-api skill has several updates: it supports managing OpenTelemetry targets with service account keys and Workload Identity Federation tokens, provides both API tracing and SDK tracing when adding OpenTelemetry, and checks online documentation before claiming a feature is unsupported. The built-in dataviz skill now accepts APCA as a text contrast metric while retaining the WCAG 2 ratios required for AA compliance.

On behavior changes: sed -i now uses the standard Bash prompt and executes as-is, no longer going through simulated file edit previews, and therefore can no longer be restored by /rewind. claude ultrareview now requires workspace trust, asking in the terminal and refusing otherwise; scripts must pass a valueless --trust-workspace or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1. On desktop and VS Code, when in bypass permission mode and encountering dangerous rm and rmdir prompts, they are now immediately rejected with a rewrite suggestion so unattended sessions can continue running.

APCA (Accessible Perceptual Contrast Algorithm) is a contrast algorithm proposed for the WCAG 3 draft. It calculates luminance contrast between foreground and background based on a perceptually uniform color space; compared with the ratio formula used in WCAG 2, its judgments for dark mode and mid-luminance text are closer to human perception. However, APCA is not yet a formal standard, and WCAG 2 AA still requires a contrast ratio of 4.5:1 (3:1 for large text), so the dataviz skill retains both metrics: APCA to guide design trade-offs, and WCAG 2 ratios to guarantee compliance.

Workload Identity Federation is a federated identity mechanism that avoids long-lived keys: external workloads (such as jobs in CI or Kubernetes service accounts) use their existing short-lived credentials to exchange for temporary access tokens from the cloud provider, avoiding storing service account keys in configuration. The /claude-api skill's support for it means authentication for OpenTelemetry export targets can use this short-lived credential path, reducing the key leakage surface.

Summary

v2.1.309 introduces no conspicuous new features; its value is concentrated in narrowing the gray areas of the sandbox and permission system. For teams relying on Claude Code for automated tasks, these fixes reduce the risk of privilege escalation in unattended scenarios and make permission prompts more predictable. Users who depend on sed -i workflows and ultrareview scripts are advised to check their existing configurations to avoid interruptions from behavior changes after upgrading.