AI library

Source · release

Claude Code releases 2.1.308 and 2.1.309

Author
Anthropic
Published
22 October 2026
Added
23 October 2026
Original
https://github.com/anthropics/claude-code/releases/tag/v2.1.309

Summary

Claude Code 2.1.309 (2026-10-22, from the GitHub release feed) is mainly a sandbox and permission hardening release. 2.1.308 (the same day) lists only "bug fixes and reliability improvements". 2.1.309 closes several ways that sandboxed or worktree-isolated commands could get past their limits. It also changes how sed -i and claude ultrareview behave, and the bundled /claude-api skill now builds Managed Agents teams on multiagent_20261001. The Python Agent SDK 0.2.172 and 0.2.173 only bundle these CLI versions.

Key points

  • Sandbox fixes: on macOS and Linux, shell startup files no longer run outside the sandbox before each sandboxed Bash command. macOS denyWrite globs now apply through symlinks. Sandboxed commands and auto-accepted edits can no longer change the file passed with --mcp-config. On Linux, sandbox write denies no longer lift when a background command outlives the session.
  • Permission fixes: an Edit(path) deny rule now blocks Bash redirects to that path in commands that also contain a subshell. Compound commands that cd (wrapped or prefixed) and then run git now prompt. Worktree isolation now refuses some locale-prefixed and zsh arithmetic commands. On Windows, PowerShell Set-Location/cd with extra arguments now prompts. PowerShell hooks that exit with code 2 now block.
  • MCP: a disabled MCP server is no longer reconnected by a later permission prompt in print and SDK sessions.
  • Behaviour changes to know about:
    • sed -i now gets the normal Bash prompt and runs as written, rather than as a simulated edit preview. /rewind no longer restores its changes.
    • claude ultrareview now requires workspace trust. In scripts, pass --trust-workspace or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1.
    • In bypass-permissions mode in Desktop and VS Code, a dangerous rm/rmdir is now denied at once with a rewrite hint, so unattended sessions keep going.
    • Worktree creation no longer fetches git objects on demand.
  • Skills: /claude-api builds Managed Agents subagent teams on multiagent_20261001 with dynamic workflows on by default, instead of coordinator. It checks the live docs before saying a feature is unsupported, and can add API tracing alongside SDK tracing. The bundled dataviz skill accepts APCA contrast and adds an apca(text, background) check. A skill in an --add-dir folder whose name clashes with another skill is now offered as <folder>:<name>.
  • Other: a nested CLAUDE.md over the size limit now loads only its start, which stops repeated compaction. Claude no longer turns role names and placeholders into GitHub @-mentions in PRs and issues. In VS Code, Edit/Write wait 0.75 s for new diagnostics, down from 1–1.5 s.

Why it matters

Several of these fixes close real sandbox escapes: startup files ran unsandboxed, and the MCP config file could be rewritten. Upgrade if you rely on the sandbox or on worktree isolation for unattended runs. Scripts that call claude ultrareview must add --trust-workspace.