Claude Code 2.1.309 fixes sandbox and permission-check bypasses and changes how `sed -i` and `rm` are handled

Claude Code v2.1.309, released October 22, 2026, per its release notes:

• Sandbox and permission fixes: sandboxed Bash commands on macOS and Linux no longer run the shell's startup files outside the sandbox before each command; macOS denyWrite globs now apply when the folder is reached through a symlink; sandboxed commands and auto-accepted edits can no longer modify the file passed with --mcp-config; Linux sandbox write denies no longer lift when a background command outlives the session. Several Bash and PowerShell permission checks that failed to prompt (compound commands with cd before git, a deny rule bypassed by a redirect in a command with a subshell, Set-Location or cd with extra arguments) now do, and worktree-isolation guards refuse some locale-prefixed and zsh arithmetic commands they used to accept.
• Behaviour changes: sed -i now gets the standard Bash prompt and runs as written, not as a simulated file-edit preview, and /rewind no longer restores it. claude ultrareview requires workspace trust: it asks on a terminal and otherwise refuses; scripts pass --trust-workspace or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1. In bypass permissions mode in the Desktop app and VS Code, the dangerous rm and rmdir prompt now denies the command at once with a rewrite hint. Commands the settings exclude from the sandbox now ask before writing to its write-list paths when the sandbox is enabled but cannot run. A nested CLAUDE.md over the size limit now loads only its start.
• Other fixes: hooks in PowerShell now block on exit code 2; messages from Claude Desktop-hosted sessions no longer get lost when the connection refreshes; Claude no longer mentions unrelated GitHub users by writing role names as mentions; and fixes for VS Code, cloud sessions, Claude Tag in Slack and Code Review.
• Improved: many git commands Claude Code runs itself are faster on Windows, and disk-full errors now name the folder to free up.