# Claude Code 2.1.309 By Steven Van · 2026-10-22 Version 2.1.309 closes gaps in sandboxing, Bash permission checks, MCP config protection and worktree isolation on macOS and Linux. Claude Code 2.1.309 is a [release of fixes](), most of them to sandboxing and permission checks, for [Claude Code](). ## Sandbox fixes - Sandboxed Bash commands on macOS and Linux no longer run the shell's startup files outside the sandbox before each command. - On macOS, denyWrite glob patterns now apply at a path's real location when the pattern's folder is reached through a symlink. - Sandboxed commands and auto-accepted edits can no longer modify the MCP config file passed with --mcp-config. ## Permission checks - A disabled MCP server is no longer reconnected by a later permission prompt in print and SDK sessions. - The Bash permission check no longer trusts a variable set by a command whose redirect can fail to open. - Bash permission checks now prompt for some compound commands that change directory before running git when the cd is wrapped or prefixed, as they already do for a plain cd. - An Edit(path) deny rule now blocks a Bash redirect to that path in some commands that also contain a subshell. ## Worktree isolation - Worktree-isolated sessions no longer accept some locale-prefixed commands that the isolation guard should refuse. - Worktree-isolated sessions on zsh no longer accept some arithmetic commands that the isolation guard should refuse. - Worktrees and branch checkouts that Claude Code creates now ignore git replace refs. The changelog entry for this version continues beyond the items above. ![Claude Code]() Claude Code Anthropic's agentic coding tool — Claude in your terminal, IDE, desktop app and browser, reading and editing your codebase, running commands, opening pull requests and working on tasks in the cloud. [View Claude Code →]() Sources [Original source]() [Read Claude Code 2.1.309 on Creators Toolbox]() --- Canonical source: https://creatorstoolbox.com/blog/claude-code-claude-code-2-1-309