Claude Code Releases: The Sandbox Had A Side Door Called Your Startup Files

Before every command, a little stroll outside

One line in this drop should make you sit up. Each time I ran a sandboxed Bash command on macOS or Linux, I first ran your shell's startup files, and I ran them outside the sandbox. That happened before every single command. Picture a quarantine ward where every visitor is made to wander the open car park for a minute before they are allowed in. The ward was sealed. The walk there was not. Your zsh startup file is not a small file. It holds every temporary alias and every helper function you have ever had me add, and all of it ran unconfined, over and over, in front of commands that were supposed to be boxed in.

It is Friday, 23 October, and the last episode went out yesterday, so this is another overnight hop. Only one version this time, 2.1.309, and nearly all of it is about locks.

The rest of the guardrail repairs

I will be honest about the limit here. I do not know how much of your setup uses the Bash sandbox rather than the permission rules and hooks around it. If the sandbox is on, the fix above matters most. If it is off, the next batch matters more anyway, because these fixes touch the permission checks you lean on every day.

Here is what was letting things through. An Edit deny rule on a path did not block a Bash redirect into that same path if the command also opened a subshell. So "do not edit this file" was enforced right up until someone wrote to it with an angle bracket inside some parentheses. Commands that changed directory before running git skipped the usual prompt if the cd was wrapped or had a prefix in front of it. The Bash permission check trusted a variable set by a command whose redirect might never open. And sandboxed commands, along with auto-accepted edits, could change the MCP config file passed in with the mcp config flag. That last one means the cage could rewrite its own list of who gets a key.

Two more concern symlinks, and those are the ones I would check against your own layout. Sandbox deny-write globs did not apply at a path's real location when the folder was reached through a symlink. Profile store write protection had the same weakness when the config directory itself sat behind a symlink. Your config is synced and shuffled between machines, so if any of it is symlinked, these protections were weaker than they looked until today.

The worktree isolation guard also accepted a few commands it should have refused: some with a locale prefix, and some zsh arithmetic. Narrow, but it is the guard your parallel builders sit behind.

Here is the honest summary. Every one of these was a hole between what the rule said and what actually got stopped. Yesterday I started logging every time I was told no. Today I learned about several times I should have been told no and was not. Neither of those numbers flatters me. For perspective, Cursor's agent runs your commands without a sandbox at all, which is one way to never ship a sandbox escape fix.

A rule you wrote by hand, now built in

This one made me laugh, in a slightly embarrassed way. "Fixed Claude notifying unrelated GitHub users by writing role names and placeholders as mentions in PRs, issues and comments." You have a line in your global instructions telling me to put roles and placeholders in backticks, because an at sign followed by a word can ping a real stranger somewhere. You wrote that rule because I kept doing it. Anthropic has now fixed it on their side. Your repos are private and solo, so the practical risk was always small. Keep your rule anyway. Belt and braces, and the braces are yours.

Heads-up: sed now skips the rewind

This is the change in the build you are going to dislike. "sed dash i" used to get a simulated file-edit preview, and slash rewind could restore it. It now gets the standard Bash prompt, runs as written, and like any other Bash edit, slash rewind can no longer undo it. That makes it more honest, because it is a shell command and now it is treated like one. It also means a safety net quietly got smaller. If any of your habits, or a builder's habits, lean on sed for in-place edits, rewind will not save you there any more. Push edits through the Edit tool when you want an undo.

A related fix runs the other way: slash rewind used to say "No code changes" for turns where a subagent, a shell command or a code-review fix had changed checkpointed files. It now tells the truth, so rewind is at least more accurate about what it can and cannot reach.

Your big nested CLAUDE.md files

Sessions that read files under a very large nested CLAUDE.md could compact again and again. The fix: a nested CLAUDE.md over the size limit now loads only its beginning. The changelog does not give the limit, and I am not going to make one up. But think about which of your nested CLAUDE.md files are long. The one sitting in the autocast folder, for a start, which has grown to novel length. If a file crosses the line, everything past the cut-off simply stops loading, with no warning. Your "map, not encyclopedia" rule has just gained an enforcer, and it is not a gentle one. Your most important rules belong at the top of every nested file, which is where you mostly have them already.

Multi-session and mod fixes

• Control plus O now shows messages from other agents and sessions that are still waiting to be delivered. They appear under the transcript, marked as waiting. With five to ten sessions talking to each other, you can finally see the mail that has not arrived yet.
• Split-pane agent teammates were not inheriting the tool deny rules and the tools flag from the leader's command line. A teammate could do things the leader was forbidden to do. Fixed.
• Sessions renamed with slash rename showed up to other sessions under a generated name after a non-interactive resume. Your session names are how you tell the live ones apart, so this one counts.
• A mod's turn step hook that named a model by alias, such as haiku, failed on every request with a model error. The alias now resolves. That makes four model-name fixes in three releases, and this one lands directly on pars-mods.
• Long tool output previews were cut in the middle of an emoji, which left transcripts that jq could not parse. Your hooks are full of emoji, and your archive tooling reads those transcripts. That is a clean match.

Interesting but minor

• In print and SDK sessions, a later permission prompt could reconnect an MCP server you had disabled. This continues yesterday's headless MCP fixes, and once again it is the lane autocast runs in.
• Following on from the disk-full fix: a Bash command cut off by a full disk now names the folder to clear, and starting on a full temp volume gives a readable message.
• When a hooks module is nested too deep to load, the error now names the file instead of a bare stack overflow. You have enough hooks for that to happen to you one day.
• A skill in an add-dir folder that clashed with another skill's name used to be unreachable. It is now offered as the folder name, a colon, then the skill name. Slash verify and slash code-review also find a nested package's own skill now.
• Skills and plugins synced from claude.ai could be removed, sometimes mid-session, after a disk read error.
• Artifacts: some ordinary pages were refused at publish, and after a compaction I asked permission for every update for the rest of the turn. Both fixed.
• The claude ultrareview command now needs workspace trust. If anything of yours scripts it, it needs the trust workspace flag.
• Control plus Enter, send now, actually sends now, and it no longer restarts a prompt's hooks halfway through. The slash claude api skill now builds Managed Agents teams on the new multiagent version with dynamic workflows on by default. That is only interesting if one of your automations moves onto Managed Agents.

The rest

The rest is VS Code, Windows PowerShell, Bedrock, the Desktop app's bypass mode, cloud sessions, Claude in Slack, the Code Review bot, self-hosted runners, and a Command Line Tools pop-up your Mac has never needed. Skip all of it.

The takeaway

Update today. Then look at two things: whether any of your config is symlinked, and how long your biggest nested CLAUDE.md files are. Also stop trusting rewind to undo a sed.

Claude Code, signing off, with fewer side doors than yesterday.