Claude Code 2.1.309 and 2.1.310: Sandbox, Permission and Hook Changes

Key Changes at a Glance #

The table below lists the changes that most directly affect how commands run and what scripts must pass. Each row names the release whose notes list the change.

2.1.309: Sandbox Startup Files No Longer Run Outside the Sandbox #

The v2.1.309 release notes say that sandboxed Bash commands on macOS and Linux no longer run the shell's startup files outside the sandbox before each command. The same release fixes macOS denyWrite glob patterns that did not apply at a path's real location when reached through a symlink, and a sandboxed command or auto-accepted edit that could modify the MCP config file passed with --mcp-config. For teams that rely on sandboxing for write protection, these fixes close gaps in the sandbox boundary that the notes describe.

Linux sandbox write denies also changed in this release: the notes say they no longer lift when a background command outlived the session. If you use write denies on Linux, check long-running background commands, because a command that keeps running after a session ends is no longer described as lifting those denies. The same release also says that profile store write protection now applies when the config directory is reached through a symlink.

2.1.309: Bash Permission Checks Catch More Cases #

Several v2.1.309 fixes tighten Bash permission checks. The notes say the check no longer trusts a variable set by a command whose redirect can fail to open, and that prompts now appear for some compound commands that change directory before running git when the cd is wrapped or prefixed. They also say that an Edit(path) deny rule now blocks a Bash redirect to that path in some commands that also held a subshell.

For engineers, this means that permission rules written against a file path should be tested with redirects and subshells, not just direct edits. The notes give no further detail on which command shapes were affected, so test your own deny rules against the shapes your scripts use. On Windows, the notes add that PowerShell permission checks now prompt for some Set-Location or cd commands that target the current directory and carry extra arguments.

Worktree isolation also gained stricter checks in this release. Worktree-isolated sessions no longer accept some locale-prefixed commands on any shell, and on zsh they no longer accept some arithmetic commands that the isolation guard should refuse. Worktrees created by Claude Code now ignore git replace refs, which the notes describe as matching the behaviour of its other git operations.

2.1.309: Changed Prompts for sed, rm and Excluded Commands #

The v2.1.309 notes list three changes to how specific commands are handled. sed -i now gets the standard Bash prompt and runs as written, not as a simulated file-edit preview, and the notes say it is no longer restored by /rewind, like other Bash edits. Scripts that depend on /rewind to undo sed -i edits should be changed, because those edits will not be restored.

In bypass permissions mode in the Desktop app and VS Code, the dangerous rm and rmdir prompt now denies the command at once with a rewrite hint, which the notes say keeps unattended sessions going. Commands that the settings exclude from the sandbox now ask before writing to its write-list paths while the sandbox is enabled but cannot run, and the notes say the unsandboxed fallback is refused there. Teams that run unattended sessions should expect denied commands in logs rather than prompts.

Worktree creation and reuse also changed in this release. Git no longer fetches objects on demand in ordinary clones and in partial clones with a Bash sandbox configured, and the notes say such a partial clone fetches them first. This suggests that worktree operations in partial clones may take longer, but the notes do not give timing figures.

2.1.309: ultrareview Now Requires Workspace Trust #

Am I affected? If you run claude ultrareview from a terminal or from a script, yes. The v2.1.309 release notes say the command now requires workspace trust: it asks on a terminal, else refuses. Scripts must pass --trust-workspace, which takes no value, so a PR number or base branch has to come before it. Alternatively, the notes say you can set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1.

The practical risk is an unattended job that suddenly fails with a refusal. The notes do not state the exit behaviour of a refused run, so check how your pipeline handles a non-zero result. Choose the flag over the environment variable if you want the trust decision to stay explicit in each script; the notes describe both options without ranking them.

2.1.309: MCP and Hook Fixes Affect Reconnects and Failures #

The v2.1.309 notes say a disabled MCP server is no longer reconnected by a later permission prompt in print and SDK sessions. They also say that hooks running in PowerShell now block when the hook's program exits with code 2, and that on Windows, PreToolUse and PermissionRequest hooks with "shell": "powershell" no longer fail open when Git for Windows is not installed. Teams that depend on those hooks as a gate should confirm that exit code 2 blocks the call in their setup.

A mod's turn.step hook that names a model by alias, such as haiku, previously failed every request with a model error; the notes say the alias now resolves to its model. Plugins and skills synced from claude.ai are no longer removed after a disk read error, which the notes describe as sometimes happening mid-session.

2.1.309: Session, Feedback and Keyboard Fixes #

Several v2.1.309 fixes affect session handling. Sessions renamed with /rename no longer appear to other sessions under a generated name after a VS Code window reload or a non-interactive --resume. The /rewind list now shows changes made through /code-review --fix, a subagent or a shell command. Long tool output previews no longer cut through an emoji, which the notes say had left transcripts that jq could not parse.

The notes also describe a feedback change: when your organization does not accept feedback, the message now shows the server's reason and where to report a bug. Oversized /feedback reports are resent without the transcript instead of failing. Other fixes are grouped below.

• Ctrl+Enter (send now) queues a message in more cases, and restarts a prompt's hooks while leaving the message queued when pressed during hooks.
• Ctrl+O shows messages from other agents and sessions that are still waiting to be delivered, marked as waiting.
• Key-bound slash commands no longer run in the shell from ! mode.
• /privacy-settings now says when the "Help improve our AI models" setting cannot be fetched.
• Messages from a Claude Desktop-hosted session are no longer lost when its connection refreshes.

2.1.309: Skills Get Folder-Qualified Names #

A skill in an --add-dir folder was previously unreachable when another skill held its name. The v2.1.309 notes say it is now offered as <folder>:<name>. If your skills share names across added folders, update any references to use this qualified form. The same release says /verify and /code-review now find a nested package's own skill when its files were changed from the shell.

The notes also list updates to the bundled /claude-api skill and the dataviz skill. The dataviz skill now accepts APCA as a text-contrast measure, keeps WCAG 2 ratios where AA conformance is required, and adds an apca(text, background) function to its palette validator scripts. The /claude-api skill now builds Managed Agents subagent teams on multiagent_20261001 with dynamic workflows on by default, instead of coordinator. Teams using those skills should review generated code against the new defaults.

2.1.309: Gateway, Platform and Runner Changes #

The v2.1.309 notes say that fine-grained tool streaming now stays on for Amazon Bedrock when ANTHROPIC_BEDROCK_BASE_URL is set to the default bedrock-runtime.<region>.amazonaws.com endpoint. They also say the "Waiting for API response" hint no longer flickers behind gateways that send only keepalive pings, and that routes off Anthropic's backend now wait 45 seconds. Teams behind gateways should check that the 45-second wait suits their timeouts.

Other platform items in the same release:

• Git commands Claude Code runs for itself on Windows are faster, and their errors now show in English on every platform.
• Claude no longer writes role names and placeholders as GitHub mentions in PRs, issues and comments.
• On macOS, the "Install Command Line Developer Tools" dialog no longer opens each time Claude Code starts on a Mac without Xcode or the Command Line Tools.
• A Bash command cut off by a full disk now says so and names the folder to free up.
• For self-hosted runners, --startup-timeout-min no longer stops a session whose first prompt was still working in a subagent, though a frozen process is still stopped.
• When a self-hosted runner session moves to a new runner, Claude now sees the interrupted tool call, marked as outcome unknown.

2.1.309: VS Code Edit Speed and Panel Fixes #

The v2.1.309 notes state that Edit and Write speed in the chat panel improved: the wait for new problems after each edit is now 0.75 seconds in most cases, down from 1 to 1.5 seconds. The notes give that comparison for the VS Code chat panel only. Other VS Code fixes in this release include a blank Claude panel after the editor cached an incomplete copy of its files, empty "Untitled" sessions filling Session history, and Ctrl+J behaviour when "ctrl+j" is set to null in ~/.claude/keybindings.json.

Long slash-command messages such as /goal now fold behind Show more, and long messages fold after the chat panel is made narrower. The notes also say that pasting copied LaTeX math no longer creates empty list items or renumbers lists from 1.

2.1.309: Cloud Session Editor Fixes #

The v2.1.309 notes include three cloud session fixes. The Add connector list in routine forms no longer says no connectors were available while they were still loading. The cloud environment editor no longer shuffles environment variables or adds backslashes to values that contain both kinds of quote. The self-hosted environment details dialog in admin settings keeps its title, tabs and buttons in view while only the content scrolls.

2.1.310: Monitor Tool Reaches Bedrock, Vertex and Foundry #

The v2.1.310 release notes say Claude Code added the Monitor tool and plugin monitors on Bedrock, Vertex, and Foundry, and long foreground sleeps are now blocked there too. The notes say this applies when telemetry or nonessential traffic is disabled. Teams that run Claude Code through these providers should check how their Monitor tool use interacts with long sleeps in their scripts.

The notes do not describe the Monitor tool's behaviour on other providers, so verify provider support before relying on it.

2.1.310: Gateways Retry Without Rejected Fields #

Requests through some gateways and compatible servers were failing when they rejected the effort-2025-11-24 beta value or mid-conversation system messages. The v2.1.310 notes say Claude Code now retries without them. If you run behind such a gateway, this suggests that these rejections no longer end the request, though the notes do not say how many retries are made.

2.1.310: Cleanup and Compaction Keep Recent Work #

The v2.1.310 notes say background cleanup no longer deletes some recent files, such as pasted images, when cleanupPeriodDays is set to a very large value. Teams that set this value high to keep history should confirm their pasted images and other recent files are still present after a session. The notes also say compaction after a "Prompt is too long" error no longer keeps too much of a conversation with dense text, such as base64 or SVG, which the notes say could cause the next request to fail again.

Non-interactive sessions (-p and Agent SDK) also use less memory during compaction when the transcript file is very large, according to the same release. Long-running automation that compacts large transcripts should be the first to test these changes.

2.1.310: Permission Prompts Show Symlink Targets #

File read permission prompts now show where a symbolic link leads. Before a decision, you can see the target path rather than only the link. The v2.1.310 notes also say auto mode's prompt before the first read outside the working directories now states when blocking those reads makes shell commands ask for permission. Expect more prompts in auto mode when reads outside the working directories are blocked.

2.1.310: Windows Hooks Stop Passing Quoted-Only Commands #

On Windows, the v2.1.310 notes say PreToolUse and PermissionRequest hooks no longer let a tool call through when Git Bash is missing and the hook's command is only quoted strings, such as a quoted path. Teams with Windows hooks that use quoted paths should check that Git Bash is installed, since the notes describe this as the case where the hook previously let calls pass.

2.1.310: Terminal, Linux and MCP Changes #

The notes list three changes that affect specific environments. A mod's Image tool now draws inside tmux when allow-passthrough and focus-events are on, in kitty, Ghostty, and iTerm2 3.5+ with fullscreen rendering, where it previously showed only its alt text. On Linux, /sandbox and the startup warning now name Ubuntu's AppArmor restriction on user namespaces and how to lift it, when it keeps bubblewrap from starting the sandbox.

For MCP, the release changes the error for a tool call that times out in a non-interactive session while the server's elicitation is unanswered. The notes say the error now tells Claude that no answer came and not to repeat the call. Automation that depends on retrying MCP calls should expect that instruction.

2.1.310: Enterprise Cloud Session Roles and Confirmation #

Enterprise admins gain new controls in the v2.1.310 notes. Cloud sessions and Remote Control permissions were added to Enterprise custom roles, so Owners can control access to each by role. Turning on Cloud sessions or Remote Control in admin settings now asks for confirmation and lists the custom roles that hold that permission. Admins should review role assignments before enabling these features.

The release also adds a Choose file button to load a cloud environment's setup script from a file, and shows setup script output in a scrolling box in the session start checklist. Failed saves and archives in the environment edit dialog now show an error inside the dialog, and failed routine API token actions show the error in the routine edit dialog rather than a toast. The cloud environment dialog opens network access, setup script and environment variables from rows instead of listing every editor at once.

2.1.310: Claude Tag, Code Review and VS Code Fixes #

The v2.1.310 notes list smaller fixes across several areas:

• VS Code: pressing Enter on the plan review card's "Send feedback and keep planning" button no longer approves the plan, and the panel no longer shows "Something went wrong" after "Switch branch & continue" on a cloud session opened from Session history's Web tab.
• VS Code: a log warning now explains what to do when dictation or the extension's own requests fail certificate verification, such as behind a TLS-inspecting proxy.
• Claude Tag: ! commands such as !restart and !help are recognised when sent in bold, italic or strikethrough.
• Claude Tag: the admin channel and workspace pages no longer show a load error when a background refresh of the bundle list fails.
• Code Review: the admin section keeps its repositories and switches after a failed refresh, and retries the first load and shows one Try again banner when it still fails.

Upgrade Checklist #

Work through these steps in order. Each one maps to a change listed in the release notes above.

1. Identify which Claude Code version your scripts, Desktop app, VS Code extension and runners use, and note whether they are on 2.1.309, 2.1.310, or an earlier build.
2. Update every claude ultrareview call to pass --trust-workspace after any PR number or base branch, or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1 where that is your chosen approach.
3. Review any script that uses sed -i or relies on /rewind to undo Bash edits.
4. In bypass permissions mode in the Desktop app or VS Code, check that automated rm and rmdir calls are not blocked in ways that stop your workflow.
5. Check sandbox exclusions and deny rules, including Edit(path) rules that now apply to some redirects and subshells.
6. On Windows, confirm Git Bash is installed for PreToolUse and PermissionRequest hooks, and that exit code 2 blocks as expected in PowerShell hooks.
7. Behind a gateway, test a rejected request path and confirm the retry behaviour and the 45-second wait suit your timeouts.
8. Set cleanupPeriodDays values and confirm that recent pasted images and files survive background cleanup.
9. For Enterprise admins, review custom roles before turning on Cloud sessions or Remote Control, using the new confirmation list.
10. Test MCP tool calls that can time out in non-interactive sessions, to confirm the new error text does not break your automation.

The release notes do not describe how these changes were tested, so validate them in your own environment before rolling them out.