Claude Code v2.1.309 Patches Sandbox Escapes, Symlink Deny Rules, and MCP Config Tampering

Claude Code v2.1.309 is a security-heavy release that closes several sandbox escape vectors and permission-check bypasses on macOS, Linux, and Windows. The fixes land across Bash sandboxing, MCP config protection, worktree isolation, and hook execution.

Sandbox and filesystem fixes

• Sandboxed Bash commands on macOS and Linux no longer run the shell's startup files outside the sandbox before each command.
• macOS sandbox denyWrite glob patterns now apply at a path's real location when the pattern's folder is reached through a symlink.
• Sandboxed commands and auto-accepted edits can no longer modify the MCP config file passed with --mcp-config.
• Profile store write protection now applies when the config directory is reached through a symlink.

Permission and isolation fixes

• Bash permission checks no longer trust a variable set by a command whose redirect can fail to open.
• Compound commands that change directory before running git now prompt for permission even when the cd is wrapped or prefixed — matching behavior for a plain cd.
• An Edit(path) deny rule now blocks a Bash redirect to that path when the command also holds a subshell.
• Worktree-isolated sessions refuse locale-prefixed commands and zsh arithmetic commands that the isolation guard should reject.
• Split-pane agent teammates now inherit the leader's tool deny and --tools rules.

Session and MCP fixes

• A disabled MCP server is no longer reconnected by a later permission prompt in print and SDK sessions.
• Worktrees and branch checkouts created by Claude Code now ignore git replace refs, consistent with its other git operations.
• Sessions stop compacting repeatedly after reading files under a very large nested CLAUDE.md; a nested CLAUDE.md over the size limit now loads only its start.
• Messages from other agents and sessions still waiting to be delivered now appear in full under the transcript (ctrl+o), marked as waiting.

Hooks, skills, and UI

• PowerShell hooks now block when the hook's program exits with code 2, and Windows PreToolUse and PermissionRequest hooks with "shell": "powershell" no longer fail open when Git for Windows isn't installed.
• A mod's turn.step hook naming a model by alias (e.g., haiku) now resolves to its model instead of failing every request.
• Skills in --add-dir folders are now reachable as <folder>:<name> when another skill holds the same name.
• ctrl+enter (send now) behavior is fixed both before a response starts and while a prompt's hooks are running.
• Long tool output previews are no longer cut through an emoji, keeping session transcripts parseable by jq.

If you run Claude Code in sandboxed or worktree-isolated modes, upgrade. The symlink and --mcp-config fixes are the ones to prioritize.