Claude Code 2.1.325 fixes a zstd decoding security issue and makes sandboxed Bash commands ask for permission by default

Claude Code v2.1.325, released November 13, 2026, per its release notes, includes a security fix for how zstd-compressed responses are decoded, tighter permission and sandbox behavior, and a long list of fixes.

Changes that may affect existing setups:

• Sandboxed Bash commands now follow the normal permission flow by default. Set sandbox.autoAllowBashIfSandboxed: true to keep running them without prompts; for managed settings that turn the sandbox on, set it in the highest-ranking managed source.
• Read-only git commands ask first in a repository that is not the project's or a trusted one; naming it with --add-dir (not the additionalDirectories setting) avoids the prompt.
• Scheduled tasks and /loop ask before running a skill that declares allowed-tools or hooks; add Skill(name) to permissions.allow to run it unattended.
• "Always allow" in Desktop, IDE and SDK hosts offers a rule alone only when saving it would allow that command again, so a scheduled task that relied on one may now wait for input.
• The sandbox refuses writes to .claude settings, skills, agents, commands and hooks in added directories, as it already does in the launch folder.
• An isolated worktree session or agent is refused git bisect run, git maintenance register|start and scalar's set-up commands.
• Plugin MCP bundles (.mcpb, .dxt) unpack under the plugins directory; pluginDigests is deprecated and ignored; .claude/skills folders in --plugin-dir plugins no longer load from a session started above them.
• Marketplace ref accepts the full ID of any commit; clients before this version cannot clone such a pin. Plugin downloads use a CONNECT tunnel when ALL_PROXY is the only proxy set, and a proxy that refuses CONNECT now fails them.
• claude remote-control exits with status 4 when it stops by itself and 69 when it cannot register.
• CLAUDE_CODE_MAX_CONTEXT_TOKENS also sets the context window of unrecognized claude- model IDs, such as a gateway's alias.

Permission and sandbox fixes cover cases where a compound Bash command could run without asking, a Bash allow rule could run a different program than the one it names, some deny and ask rules did not apply, relative deny rules such as Read(./.env) stopped covering the project after a cd, and the Bash sandbox did not fully protect a worktree's settings, hooks and shared git folder. Several fixes cover Artifact publishing to pages visible outside an organization.

Other additions: in VS Code, prompt suggestions (Tab accepts) and a Console sign-in that creates no API key; a spinner tip about re-running a notebook cell; a hint under policy-blocked errors to run /rewind or /clear. The rest are fixes to sign-in and login, MCP tasks and elicitation, subagent models, session resume, OpenTelemetry events, and Windows and Linux behavior.