Claude Code v2.1.309: sandbox and permission-boundary fixes, ultrareview workspace trust#

Published by

Part of the Claude Code Version Tracker series. | Official Env Vars | Official Changelog

Claude Code v2.1.309, following v2.1.307 (v2.1.308 shipped bug fixes only), fixes a batch of cases where a sandboxed command, a Bash deny rule, or worktree isolation could be bypassed through a symlink, a wrapped cd, a subshell redirect, or a locale prefix.[1] It also makes claude ultrareview require workspace trust and stops an oversized nested CLAUDE.md from forcing repeated compaction.[1]

The checks now follow a command's real target#

Most of the release lands on the permission and sandbox boundaries. The shared change: a check resolves where a command actually reads or writes before it decides, rather than taking the written command at face value.[1]

  • A sandboxed Bash command on macOS and Linux no longer runs the shell's startup files outside the sandbox before each command.[1]
  • A macOS denyWrite glob now applies at a path's real location when the pattern's folder is reached through a symlink, and profile-store write protection applies through a symlinked config directory.[1]
  • Sandboxed commands and auto-accepted edits can no longer modify the MCP config file passed with --mcp-config.[1]
  • The Bash permission check no longer trusts a variable set by a command whose redirect can fail to open, and now prompts for compound commands that change directory before running git when the cd is wrapped or prefixed, as it already did for a plain cd.[1]
  • An Edit(path) deny rule now blocks a Bash redirect to that path in commands that also hold a subshell.[1]
  • Worktree-isolated sessions now refuse locale-prefixed commands, and on zsh some arithmetic commands, that the isolation guard should have refused.[1]
  • On Windows, PowerShell permission checks now prompt for Set-Location or cd commands that target the current directory and carry extra arguments; on Linux, sandbox write denies no longer lift when a background command outlives the session.[1]

ultrareview now asks about the workspace#

claude ultrareview now checks that you trust the workspace before it runs. On a terminal it asks; a non-interactive run refuses unless told the folder is trusted.[1] Scripts pass --trust-workspace, which takes no value and goes before a PR number or base branch, or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1.[1]

Session and transcript fixes#

  • A nested CLAUDE.md over the size limit now loads only its start, which stops the repeated compaction that reading large nested files under it caused.[1]
  • A Bash command cut off by a full disk now says so and names the folder to free up, and starting on a full temp volume prints a clear message instead of a raw ENOSPC.[1]
  • ctrl+o now shows messages from other agents and sessions that are still waiting to be delivered, in full under the transcript and marked as waiting.[1]
  • /rewind now lists a turn that changed checkpointed files through /code-review --fix, a subagent, or a shell command, instead of reporting "No code changes".[1]
  • Claude no longer notifies unrelated GitHub users by writing role names and placeholders as mentions in PRs, issues, and comments.[1]

New Environment Variables#

VariableWhat It Does
CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECKSet to 1 to skip the workspace-trust gate that claude ultrareview added in v2.1.309. Without it, ultrareview asks for trust on a terminal or refuses to run; --trust-workspace grants it inline.[1]

One boundary, enforced on the real path#

The sandbox and permission fixes share a direction: a rule you wrote is now checked against where a command actually reads or writes, after the symlink is resolved, the wrapped cd is read, the subshell redirect is followed, and the variable a failed redirect never set is distrusted.[1] An allow-list or deny rule that looked tight on v2.1.307 but leaked through one of those indirections behaves differently now, so a workspace whose safety depended on a specific command shape is worth re-checking against the updated boundary.

Sources#

  1. Claude Code Official Changelog, v2.1.309 release notes

This analysis is conducted for educational and research purposes under fair use principles. All trademarks and software referenced belong to their respective owners.

Let's Connect

BlueskyLinkedInThreads

Previous Claude Code analysis: v2.1.307 (October 21, 2026)

All 79 Claude Code analyses: Claude Code Version Tracker · Official Claude Code changelog

← Back to all posts