Claude Code v2.1.309 Release Notes — What's New

What's changed

Fixed sandboxed Bash commands on macOS and Linux running the shell's startup files outside the sandbox before each command
Fixed macOS sandbox denyWrite glob patterns not applying at a path's real location when the pattern's folder is reached through a symlink
Fixed sandboxed commands and auto-accepted edits being able to modify the MCP config file passed with --mcp-config
Fixed a disabled MCP server being reconnected by a later permission prompt in print and SDK sessions
Fixed the Bash permission check trusting a variable set by a command whose redirect can fail to open
Fixed Bash permission checks not prompting for some compound commands that change directory before running git when the cd is wrapped or prefixed, as they do for a plain cd
Fixed an Edit(path) deny rule not blocking a Bash redirect to that path in some commands that also held a subshell
Fixed worktree-isolated sessions accepting some locale-prefixed commands the isolation guard should refuse
Fixed worktree-isolated sessions on zsh accepting some arithmetic commands that the isolation guard should refuse
Fixed worktrees and branch checkouts that Claude Code creates so they ignore git replace refs, as its other git operations already do
Fixed profile store write protection not applying when the config directory is reached through a symlink
Fixed sessions compacting repeatedly after reading files under a very large nested CLAUDE.md; a nested CLAUDE.md over the size limit now loads only its start
Fixed ctrl+enter (send now) only queuing a message when pressed before the response had started, and restarting a prompt's hooks while leaving the message queued when pressed while those hooks were running
Fixed key-bound slash commands running in the shell from ! mode
Fixed ctrl+o not showing messages from other agents and sessions that are still waiting to be delivered; they now appear in full under the transcript, marked as waiting
Fixed long tool output previews being cut through an emoji, leaving session transcripts that jq could not parse
Fixed Read reporting "File does not exist" for PDF page ranges in Linux sandboxes that share the parent's /proc
Fixed messages from a Claude Desktop-hosted session sometimes being lost when its connection refreshed
Fixed features missing from Claude Code sessions in the Claude desktop app when the terminal on the same computer was signed in to a different account or organization
Fixed the claude remote-control status line showing HEAD as the branch for a folder that is not in a git repository
Fixed split-pane agent teammates not inheriting the tool deny and --tools rules given on the leader's command line
Fixed sessions renamed with /rename appearing to other sessions under a generated name after a VS Code window reload or a non-interactive --resume
Fixed the /rewind list showing "No code changes" for a turn that changed checkpointed files through /code-review --fix, a subagent or a shell command
Fixed /privacy-settings showing an out-of-date "Help improve our AI models" value; it now also says when the setting can't be fetched
Fixed feedback saying "try again later" when your organization does not accept feedback; it now shows the server's reason and where to report a bug
Fixed oversized /feedback reports failing instead of being resent without the transcript
Fixed a skill in an --add-dir folder being unreachable when another skill already held its name; it is now offered as <folder>:<name>
Fixed /verify and /code-review not finding a nested package's own skill when its files were changed from the shell
Fixed the /claude-api skill saying that ant beta:worker poll --on-work passes trace context to the command
Fixed the /claude-api skill's C# tracing setup missing spans from the cloud platform clients
Fixed the /claude-api skill saying that API spans for requests to Claude Platform on AWS can't join the caller's trace
Fixed hooks that run in PowerShell not blocking when the hook's program exits with code 2, and on Windows PreToolUse and PermissionRequest hooks with "shell": "powershell" failing open when Git for Windows isn't installed
Fixed a mod's turn.step hook that names a model by alias, such as haiku, failing every request with a model error: the alias now resolves to its model
Fixed plugins and skills synced from claude.ai being removed, sometimes mid-session, after a disk read error
Fixed artifact publishes and updates being refused for some ordinary pages, such as pages with certain minified scripts or artifacts Claude could not read first
Fixed Claude asking for permission on each artifact update for the rest of a turn after the conversation was compacted in that turn
Fixed fine-grained tool streaming staying off on Amazon Bedrock when ANTHROPIC_BEDROCK_BASE_URL is set to the default bedrock-runtime.<region>.amazonaws.com endpoint
Fixed the "Waiting for API response" hint flickering behind gateways that send only keepalive pings: routes off Anthropic's backend now wait 45 seconds
Fixed Claude notifying unrelated GitHub users by writing role names and placeholders as mentions in PRs, issues and comments
Linux: Fixed sandbox write denies lifting when a background command outlived the session
Windows: Fixed PowerShell permission checks auto-approving some Set-Location or cd commands that target the current directory and carry extra arguments; these now prompt for approval
macOS: Fixed the "Install Command Line Developer Tools" dialog opening each time Claude Code starts on a Mac without Xcode or the Command Line Tools
Self-hosted runner: Fixed --startup-timeout-min stopping a session whose first prompt, such as /code-review, was still working in a subagent; a frozen process is still stopped
Improved the speed of many git commands Claude Code runs for itself on Windows; on every platform, errors from those commands now show in English even when git is set to another language
Improved the error when a hooks module is nested too deep to load: it now names the file instead of showing a bare stack-overflow message
Improved disk-full handling: a Bash command cut off by a full disk now says so and names the folder to free up, and starting on a full temp volume prints a clear message, not a raw ENOSPC error
Improved the /claude-api skill to offer API tracing alongside SDK tracing when asked to add OpenTelemetry
Improved the /claude-api skill to check the live docs before saying a feature is unsupported
Self-hosted runner: Improved sessions that move to a new runner: Claude now sees the tool call that was interrupted, marked as outcome unknown
Updated the bundled dataviz skill to accept APCA as a text-contrast measure (keeping WCAG 2 ratios where AA conformance is required), add an apca(text, background) function to its palette validator scripts, and say whether a label inside a colored chart fill should be white or near-black
Updated the /claude-api skill: service account keys and Workload Identity Federation tokens can now manage OpenTelemetry destinations
Changed sed -i to get the standard Bash prompt and run as written, not a simulated file-edit preview; like other Bash edits, it is no longer restored by /rewind
Changed claude ultrareview to require workspace trust: it asks on a terminal, else refuses; scripts pass --trust-workspace, which takes no value (put a PR number or base branch before it), or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1
Changed the dangerous rm and rmdir prompt in bypass permissions mode in the Desktop app and VS Code to deny the command at once with a rewrite hint, so unattended sessions keep going
Changed commands the settings exclude from the sandbox to ask before writing to its write-list paths while the sandbox is enabled but cannot run; the unsandboxed fallback is refused there

…