Claude Code v2.1.309: Sandbox and Permission Fixes

Claude Code v2.1.309 is a large maintenance release from Anthropic. Most of its changes tighten sandboxing and permission checks, and a few change existing behavior. If you run Claude Code in sandboxed, worktree-isolated, or scripted setups, read this release before you upgrade.

What happened

The v2.1.309 release notes were published on October 22, 2026. They list dozens of fixes, several improvements, and a set of behavior changes. Sandbox, Bash permission, and isolation fixes make up a large share of the list.

Key details

Sandbox and permissions. The release notes describe these fixes:

• On macOS and Linux, sandboxed Bash commands no longer run the shell’s startup files outside the sandbox before each command.
• On macOS, denyWrite glob patterns now apply at a path’s real location even when the folder is reached through a symlink.
• Sandboxed commands and auto-accepted edits can no longer modify the MCP config file passed with --mcp-config.
• An Edit(path) deny rule now blocks a Bash redirect to that path in some commands that also held a subshell.
• Worktree-isolated sessions now refuse some locale-prefixed commands and, on zsh, some arithmetic commands.
• On Windows, PowerShell checks no longer auto-approve some Set-Location or cd commands that carry extra arguments.

Hooks. Hooks that run in PowerShell now block when the hook’s program exits with code 2. On Windows, PreToolUse and PermissionRequest hooks with "shell": "powershell" no longer fail open when Git for Windows isn’t installed.

Behavior changes.

• sed -i now uses the standard Bash prompt and runs as written. /rewind no longer restores its edits.
• claude ultrareview now requires workspace trust. Scripts can pass --trust-workspace or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1.
• In bypass permissions mode in the Desktop app and VS Code, dangerous rm and rmdir commands are now denied at once with a rewrite hint, so unattended sessions keep going.

Other fixes. A nested CLAUDE.md over the size limit now loads only its start, which stops sessions from compacting repeatedly. The /claude-api skill received several tracing corrections. Claude no longer notifies unrelated GitHub users by writing role names and placeholders as mentions.

Why it matters for Claude builders

If you rely on the sandbox, deny rules, or worktree isolation as a safety boundary, this release closes several gaps where those protections did not apply as intended.

The behavior changes can break existing automation:

• CI scripts that call claude ultrareview. These now need --trust-workspace or the environment variable listed above.
• Workflows that expect /rewind to undo sed -i edits. This no longer works.

Before you upgrade, review the full list in the release notes and test any scripts that depend on these commands.

Source

• Claude Code v2.1.309 release notes