Claude Code 2.1.309

Claude Code 2.1.309 fixes several gaps in sandboxing and permission checks.

Sandboxed Bash commands on macOS and Linux no longer run shell startup files outside the sandbox. On macOS, denyWrite glob patterns now apply at a path's real location when the folder is reached through a symlink. Sandboxed commands and auto-accepted edits also can no longer modify the file supplied through --mcp-config.

The release also fixes permission checks for some compound Bash commands and closes gaps in worktree isolation, including certain locale-prefixed commands and arithmetic commands on zsh.