claudekit / updates / claude-code-2-1-309
[ PATCH · ]

Claude Code 2.1.309

A sandbox and permission-check hardening release: fixes sandboxed Bash commands running the shell's startup files outside the sandbox, and sandboxed commands being able to modify the MCP config file passed with `--mcp-config`. Also changes `sed -i` to run as a normal Bash command and `claude ultrareview` to require workspace trust.

Claude Code
Official announcement →

This article is a summary based on official documentation.

What changed

Claude Code 2.1.309 shipped on October 22, 2026. Most of its fixes close gaps in the sandbox and permission checks: shell startup files running outside the sandbox, denyWrite patterns not applying through symlinks, and Bash permission checks not prompting for some compound commands. It also changes how sed -i, claude ultrareview, dangerous rm in bypass permissions mode and worktree creation behave, with further fixes across sessions and input, skills and hooks, the VS Code extension, cloud sessions, Claude Tag and Code Review.

Key improvements

  • Git commands on Windows, and English git errors everywhere

    Many git commands Claude Code runs for itself are faster on Windows. On every platform, errors from those commands now show in English even when git is set to another language.

  • Disk-full handling

    A Bash command cut off by a full disk now says so and names the folder to free up, and starting on a full temp volume prints a clear message, not a raw ENOSPC error.

  • Hooks module nested too deep

    The error now names the file instead of showing a bare stack-overflow message.

  • /claude-api skill

    Offers API tracing alongside SDK tracing when asked to add OpenTelemetry, and checks the live docs before saying a feature is unsupported. It now also covers service account keys and Workload Identity Federation tokens managing OpenTelemetry destinations.

  • Bundled dataviz skill

    Accepts APCA as a text-contrast measure (keeping WCAG 2 ratios where AA conformance is required), adds an apca(text, background) function to its palette validator scripts, and says whether a label inside a colored chart fill should be white or near-black.

  • [Self-hosted runner] Sessions that move to a new runner

    Claude now sees the tool call that was interrupted, marked as outcome unknown.

  • [VSCode] Edit and Write speed

    The wait for new problems after each edit in the chat panel is now 0.75 seconds in most cases, down from 1 to 1.5 seconds.

  • [VSCode] Certificate verification warning

    A log warning now says what to do when dictation or the extension’s own requests fail certificate verification, such as behind a TLS-inspecting proxy.

  • [Cloud sessions] Changes pane

    Now says when it lists only pushed commits or only Claude’s edits.

Changed behavior

  • sed -i

    Gets the standard Bash prompt and runs as written, not a simulated file-edit preview. Like other Bash edits, it is no longer restored by /rewind.

  • claude ultrareview requires workspace trust

    It asks on a terminal, else refuses. Scripts pass --trust-workspace, which takes no value (put a PR number or base branch before it), or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1.

  • Dangerous rm and rmdir in bypass permissions mode

    In the Desktop app and VS Code, the prompt now denies the command at once with a rewrite hint, so unattended sessions keep going.

  • Commands excluded from the sandbox

    While the sandbox is enabled but cannot run, commands the settings exclude from the sandbox now ask before writing to its write-list paths; the unsandboxed fallback is refused there.

  • Worktree creation and reuse

    Git no longer fetches objects on demand, in ordinary clones and in partial clones with a Bash sandbox configured; such a partial clone fetches them first.

  • /claude-api Managed Agents subagent teams

    Built on multiagent_20261001 with dynamic workflows on by default, instead of coordinator.

Bug fixes

Sandbox & permission checks

  • Sandboxed Bash commands on macOS and Linux running the shell’s startup files outside the sandbox before each command.
  • macOS sandbox denyWrite glob patterns not applying at a path’s real location when the pattern’s folder is reached through a symlink.
  • Sandboxed commands and auto-accepted edits being able to modify the MCP config file passed with --mcp-config.
  • A disabled MCP server being reconnected by a later permission prompt in print and SDK sessions.
  • The Bash permission check trusting a variable set by a command whose redirect can fail to open.
  • Bash permission checks not prompting for some compound commands that change directory before running git when the cd is wrapped or prefixed, as they do for a plain cd.
  • An Edit(path) deny rule not blocking a Bash redirect to that path in some commands that also held a subshell.
  • Worktree-isolated sessions accepting some locale-prefixed commands, and on zsh some arithmetic commands, that the isolation guard should refuse.
  • Profile store write protection not applying when the config directory is reached through a symlink.
  • Split-pane agent teammates not inheriting the tool deny and --tools rules given on the leader’s command line.
  • Linux: Sandbox write denies lifting when a background command outlived the session.
  • Windows: PowerShell permission checks auto-approving some Set-Location or cd commands that target the current directory and carry extra arguments; these now prompt for approval.

Worktrees & git

  • Worktrees and branch checkouts that Claude Code creates not ignoring git replace refs, as its other git operations already do.

Sessions, input & transcripts

  • Sessions compacting repeatedly after reading files under a very large nested CLAUDE.md; a nested CLAUDE.md over the size limit now loads only its start.
  • ctrl+enter (send now) only queuing a message when pressed before the response had started, and restarting a prompt’s hooks while leaving the message queued when pressed while those hooks were running.
  • Key-bound slash commands running in the shell from ! mode.
  • ctrl+o not showing messages from other agents and sessions that are still waiting to be delivered; they now appear in full under the transcript, marked as waiting.
  • Long tool output previews being cut through an emoji, leaving session transcripts that jq could not parse.
  • Sessions renamed with /rename appearing to other sessions under a generated name after a VS Code window reload or a non-interactive --resume.
  • The /rewind list showing “No code changes” for a turn that changed checkpointed files through /code-review --fix, a subagent or a shell command.
  • /privacy-settings showing an out-of-date “Help improve our AI models” value; it now also says when the setting can’t be fetched.
  • Feedback saying “try again later” when your organization does not accept feedback; it now shows the server’s reason and where to report a bug.
  • Oversized /feedback reports failing instead of being resent without the transcript.
  • Read reporting “File does not exist” for PDF page ranges in Linux sandboxes that share the parent’s /proc.

Skills, hooks & mods

  • A skill in an --add-dir folder being unreachable when another skill already held its name; it is now offered as <folder>:<name>.
  • /verify and /code-review not finding a nested package’s own skill when its files were changed from the shell.
  • The /claude-api skill’s tracing guidance: it no longer says that ant beta:worker poll --on-work passes trace context to the command, its C# tracing setup no longer misses spans from the cloud platform clients, and it no longer says that API spans for requests to Claude Platform on AWS can’t join the caller’s trace.
  • Hooks that run in PowerShell not blocking when the hook’s program exits with code 2, and on Windows PreToolUse and PermissionRequest hooks with "shell": "powershell" failing open when Git for Windows isn’t installed.
  • A mod’s turn.step hook that names a model by alias, such as haiku, failing every request with a model error; the alias now resolves to its model.

Plugins & artifacts

  • Plugins and skills synced from claude.ai being removed, sometimes mid-session, after a disk read error.
  • Artifact publishes and updates being refused for some ordinary pages, such as pages with certain minified scripts or artifacts Claude could not read first.
  • Claude asking for permission on each artifact update for the rest of a turn after the conversation was compacted in that turn.

Gateways & connections

  • Fine-grained tool streaming staying off on Amazon Bedrock when ANTHROPIC_BEDROCK_BASE_URL is set to the default bedrock-runtime.<region>.amazonaws.com endpoint.
  • The “Waiting for API response” hint flickering behind gateways that send only keepalive pings; routes off Anthropic’s backend now wait 45 seconds.
  • Messages from a Claude Desktop-hosted session sometimes being lost when its connection refreshed.
  • Features missing from Claude Code sessions in the Claude desktop app when the terminal on the same computer was signed in to a different account or organization.
  • The claude remote-control status line showing HEAD as the branch for a folder that is not in a git repository.
  • Claude notifying unrelated GitHub users by writing role names and placeholders as mentions in PRs, issues and comments.

Platforms & self-hosted runner

  • macOS: The “Install Command Line Developer Tools” dialog opening each time Claude Code starts on a Mac without Xcode or the Command Line Tools.
  • [Self-hosted runner] --startup-timeout-min stopping a session whose first prompt, such as /code-review, was still working in a subagent; a frozen process is still stopped.

VS Code extension

  • The Claude panel staying blank after the editor cached an incomplete copy of its files; it now recovers by itself, or says what went wrong and how to fix it.
  • Session history filling up with empty “Untitled” sessions each time you start a new session without sending a message.
  • Long slash-command messages such as /goal filling the chat panel, and long messages not folding behind Show more after the chat panel is made narrower.
  • Ctrl+J in the chat input always inserting a newline; it is now left to VS Code and the OS when “ctrl+j” is set to null in the Chat context of ~/.claude/keybindings.json.
  • A mod’s “From the … plugin” label above the prompt being drawn over the slash command and @-mention menus.
  • An empty list item, paragraph or code block, and list items renumbered from 1, when pasting copied LaTeX math.
  • The feedback error showing only an HTTP status when your organization does not accept feedback.

Cloud sessions

  • The Add connector list in routine forms saying no connectors were available while they were still loading.
  • The cloud environment editor shuffling environment variables and adding backslashes to values that contain both kinds of quote.
  • The self-hosted environment details dialog in admin settings now keeps its title, tabs and buttons in view while only the content scrolls.
  • The “read documentation” tool row showing escaped JSON instead of a readable page.

Claude Tag (Slack)

  • Claude in Slack posting a draft you approved for a channel into your DM by mistake; a post with no channel is now refused so it can go to the approved channel.
  • Allow and Deny on Claude’s approval cards doing nothing when the session had stopped; your answer now restarts the session.
  • Claude ignoring untagged messages in a Slack channel after its workspace moved to a different Claude organization, including unshared channels on Enterprise Grid.
  • Claude posting a threaded reply before reading a newer message someone had just added to that thread.
  • The Slack page in Claude Tag admin settings saying no workspaces were connected when the list failed to load; it now shows an error with a Retry button.

Code Review

  • A finished review showing no check on the pull request when earlier tries to create it failed; a final try now adds a completed check.
  • A push queued behind a running review still starting a review after @claude review stop; its check now closes and says why.

Notes

  • If you run claude ultrareview from scripts, it now refuses without workspace trust. Pass --trust-workspace after any PR number or base branch, or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1.
  • If you relied on /rewind to undo sed -i edits, it no longer restores them. sed -i now gets the standard Bash prompt and runs as written.
  • If you run unattended sessions in bypass permissions mode in the Desktop app or VS Code, dangerous rm and rmdir commands are now denied at once with a rewrite hint instead of waiting on a prompt.
  • If your settings exclude commands from the sandbox, they now ask before writing to the sandbox’s write-list paths while the sandbox is enabled but cannot run.
  • If you use worktrees in a partial clone with a Bash sandbox configured, git objects are fetched first rather than on demand.
  • If you keep a very large nested CLAUDE.md, only its start loads once it is over the size limit, so put the instructions that matter near the top.