Claude Code 2.1.309

Claude Code 2.1.309 is a release of fixes, most of them to sandboxing and permission checks, for Claude Code.

Sandbox fixes

• Sandboxed Bash commands on macOS and Linux no longer run the shell's startup files outside the sandbox before each command.
• On macOS, denyWrite glob patterns now apply at a path's real location when the pattern's folder is reached through a symlink.
• Sandboxed commands and auto-accepted edits can no longer modify the MCP config file passed with --mcp-config.

Permission checks

• A disabled MCP server is no longer reconnected by a later permission prompt in print and SDK sessions.
• The Bash permission check no longer trusts a variable set by a command whose redirect can fail to open.
• Bash permission checks now prompt for some compound commands that change directory before running git when the cd is wrapped or prefixed, as they already do for a plain cd.
• An Edit(path) deny rule now blocks a Bash redirect to that path in some commands that also contain a subshell.

Worktree isolation

• Worktree-isolated sessions no longer accept some locale-prefixed commands that the isolation guard should refuse.
• Worktree-isolated sessions on zsh no longer accept some arithmetic commands that the isolation guard should refuse.
• Worktrees and branch checkouts that Claude Code creates now ignore git replace refs.

The changelog entry for this version continues beyond the items above.

Claude Code

Anthropic's agentic coding tool — Claude in your terminal, IDE, desktop app and browser, reading and editing your codebase, running commands, opening pull requests and working on tasks in the cloud.

View Claude Code →