1 00:00:00,180 --> 00:00:04,320 Righto, before you kick off your next agent session, here's one worth two minutes. 2 00:00:05,000 --> 00:00:08,840 This is The Claude Code Changelog, brought to you by Jellypod AI. 3 00:00:09,480 --> 00:00:11,260 I'm Lachlan, and James is here too. 4 00:00:12,260 --> 00:00:13,560 No shiny new tool today. 5 00:00:13,920 --> 00:00:20,640 Two releases, 2.1.309 on October 22 and 2.1.310 on October 6 00:00:20,820 --> 00:00:25,300 23, 2026, tightened a bunch of sandbox and permission boundaries. 7 00:00:25,860 --> 00:00:28,940 If you lean on the sandbox or on hooks, this is the one to check. 8 00:00:29,510 --> 00:00:30,450 Start with the sandbox. 9 00:00:30,870 --> 00:00:36,610 The 2.1.309 notes say sandboxed Bash commands on macOS and Linux were running the 10 00:00:36,670 --> 00:00:39,850 shell's startup files outside the sandbox before each command. 11 00:00:40,390 --> 00:00:42,130 Think your bashrc or profile. 12 00:00:42,750 --> 00:00:46,510 The release notes don't describe an exploit, so this part is my reading: the command 13 00:00:46,550 --> 00:00:49,930 itself was inside the sandbox, but the setup around it wasn't. 14 00:00:50,490 --> 00:00:51,650 The fix needs no config. 15 00:00:51,950 --> 00:00:56,370 Run claude version and confirm you're on 2.1.309 or later. 16 00:00:57,170 --> 00:00:58,810 Same release, two related fixes. 17 00:00:59,410 --> 00:01:04,110 macOS denyWrite glob patterns now apply at a path's real location when the folder is 18 00:01:04,170 --> 00:01:05,090 reached through a symlink. 19 00:01:05,670 --> 00:01:10,150 And sandboxed commands and auto accepted edits could previously modify the MCP 20 00:01:10,170 --> 00:01:13,230 config file passed in with the MCP config flag. 21 00:01:13,690 --> 00:01:14,370 That's closed too. 22 00:01:14,947 --> 00:01:21,427 And if you're on Ubuntu and the sandbox just won't start, 2.1.310 helps there. 23 00:01:23,127 --> 00:01:29,427 The /sandbox command and the startup warning now name Ubuntu's AppArmor restriction 24 00:01:29,507 --> 00:01:33,687 on user namespaces, and tell you how to lift it, when that restriction keeps 25 00:01:33,747 --> 00:01:34,947 bubblewrap from starting. 26 00:01:35,547 --> 00:01:39,627 So run /sandbox, read what it says, and you won't be guessing. 27 00:01:40,258 --> 00:01:41,378 Now permission checks. 28 00:01:41,938 --> 00:01:46,998 In 2.1.309, Bash permission checks didn't prompt for some compound commands that 29 00:01:47,058 --> 00:01:51,218 change directory before running git, when the cd was wrapped or prefixed. 30 00:01:51,718 --> 00:01:54,978 A plain cd already prompted; the wrapped versions didn't. 31 00:01:55,618 --> 00:02:00,498 Also fixed: an Edit deny rule not blocking a Bash redirect to that path in some 32 00:02:00,538 --> 00:02:02,338 commands that also held a subshell. 33 00:02:02,818 --> 00:02:04,178 So here's something you can do today. 34 00:02:04,558 --> 00:02:08,418 If you have an Edit deny rule on, say, a secrets file, upgrade, 35 00:02:08,758 --> 00:02:12,577 then ask Claude to write to that file with a shell redirect and confirm it's 36 00:02:12,617 --> 00:02:13,178 refused. 37 00:02:13,818 --> 00:02:19,078 One caveat from the same release: sed with the in place flag now gets the standard 38 00:02:19,138 --> 00:02:23,278 Bash prompt and runs as written, instead of a simulated file edit preview. 39 00:02:23,798 --> 00:02:26,978 Like other Bash edits, it's no longer restored by /rewind. 40 00:02:27,495 --> 00:02:31,935 Now the one I'd flag for anyone on Windows, because it's a proper fail open. 41 00:02:32,515 --> 00:02:39,015 In 2.1.309, hooks that run in PowerShell didn't block when the hook's program exited 42 00:02:39,055 --> 00:02:40,015 with code 2. 43 00:02:40,895 --> 00:02:46,395 And PreToolUse and PermissionRequest hooks with the shell set to powershell failed 44 00:02:46,495 --> 00:02:48,995 open when Git for Windows wasn't installed. 45 00:02:49,875 --> 00:02:56,335 Then 2.1.310 caught another case: those same hooks on Windows let a tool call 46 00:02:56,375 --> 00:03:00,975 through when Git Bash was missing and the hook's command was only quoted strings, 47 00:03:01,055 --> 00:03:02,815 like a quoted script path. 48 00:03:03,895 --> 00:03:07,735 Failing open means your guardrail was silently not guarding. 49 00:03:08,795 --> 00:03:12,155 Exit code 2 is how a hook says stop, so it matters. 50 00:03:12,802 --> 00:03:13,362 So test it. 51 00:03:13,682 --> 00:03:17,142 Write a throwaway PreToolUse hook that just exits with code 2, 52 00:03:17,622 --> 00:03:20,542 trigger any tool call, and confirm Claude Code blocks it. 53 00:03:21,042 --> 00:03:24,362 Do it on a machine without Git for Windows, and on your CI runners, 54 00:03:24,402 --> 00:03:26,562 since that's where the missing Git Bash case lives. 55 00:03:27,082 --> 00:03:28,382 Then swap in your real hook. 56 00:03:29,122 --> 00:03:32,782 The changelog doesn't say how many setups were affected, so don't assume you were 57 00:03:32,822 --> 00:03:33,142 fine. 58 00:03:33,642 --> 00:03:34,122 Verify. 59 00:03:34,818 --> 00:03:38,018 A few smaller wins from 2.1.310. 60 00:03:38,678 --> 00:03:43,778 Compaction after a prompt is too long error was keeping too much dense text, 61 00:03:44,198 --> 00:03:48,718 like base64 or SVG, so the next request could fail again. 62 00:03:49,298 --> 00:03:49,778 That's fixed. 63 00:03:51,047 --> 00:03:54,627 File read permission prompts now show where a symbolic link leads, 64 00:03:54,927 --> 00:03:58,387 so you can see if a link points outside your workspace before you approve it. 65 00:03:58,967 --> 00:04:02,647 In non interactive sessions, like print mode and the Agent SDK, 66 00:04:03,087 --> 00:04:07,627 an MCP tool call that times out while the server's elicitation is unanswered now 67 00:04:07,687 --> 00:04:10,867 tells Claude that no answer came and not to repeat the call. 68 00:04:11,367 --> 00:04:13,407 That should cut retry loops in headless runs. 69 00:04:14,107 --> 00:04:17,987 And auto mode's prompt before the first read outside your working directories now 70 00:04:18,047 --> 00:04:21,167 says when blocking those reads makes shell commands ask for permission. 71 00:04:21,818 --> 00:04:26,218 So the takeaway: these are fixes, not new settings, so there's nothing to flip. 72 00:04:26,778 --> 00:04:33,618 Upgrade to 2.1.310, rerun your deny rule check, run the exit code 2 73 00:04:33,678 --> 00:04:38,598 hook test, and if you're on Ubuntu, let /sandbox tell you what's blocking 74 00:04:38,718 --> 00:04:39,258 bubblewrap. 75 00:04:39,838 --> 00:04:40,798 That's the lot for today.