Sandbox startup files
Claude Code's sandbox stops running your shell startup files outside it
- Startup files
- no longer run outside the sandbox before each Bash command
- Symlinks
- macOS denyWrite globs apply at the folder's real location
- --mcp-config
- sandboxed commands and auto-accepted edits can't modify it
- Linux
- write denies hold when a background command outlives the session
Claude Code's sandboxed Bash commands stop running your shell's startup files outside the sandbox first. Write denies now hold through symlinks and after a session ends, and your MCP config file is off limits.
Commands that now ask
>Three commands that skipped a permission check now ask first
- cd, then git
- a wrapped or prefixed cd prompts like a plain cd
- Edit(path) deny
- also blocks a Bash redirect to that path from a subshell
- Windows
- Set-Location or cd to the current folder with extra arguments prompts
Three commands that slipped past a permission check now ask. A wrapped CD before git, a Bash redirect from a subshell to a path an Edit rule denies, and on Windows, a CD carrying extra arguments.
sed -i
>sed -i now runs as written, and /rewind no longer restores it
- Before
- a simulated file-edit preview
- Now
- the standard Bash prompt, then the command as written
- /rewind
- does not restore it, like other Bash edits
Running sed in place now gets the normal Bash prompt and runs as written, not a simulated edit preview. The catch: like other Bash edits, /rewind no longer restores it.
rm in bypass mode
>In bypass permissions mode, a dangerous rm is denied with a hint
- Where
- the Desktop app and VS Code
- Commands
- dangerous rm and rmdir
- Now
- denied at once with a rewrite hint, so unattended sessions keep going
In bypass permissions mode in the desktop app and VS Code, a dangerous remove command no longer stops on a prompt. It is denied at once with a hint to rewrite it, so unattended sessions keep going.
claude ultrareview trust
>claude ultrareview now requires workspace trust
- On a terminal
- it asks first
- Without one
- it refuses
- Scripts
- opt in with a flag or an environment variable
claude ultrareview now needs workspace trust. On a terminal it asks first. Without one it refuses, so a script that runs it has to opt in.
Fixes you may have hit
>Fixed: repeated compaction, send now, and the Xcode tools dialog
- Large nested CLAUDE.md
- no repeated compaction; an oversized one loads only its start
- ctrl+enter
- sends at once, even before the response starts
- Mac without Xcode
- no Command Line Tools dialog each time Claude Code starts
Sessions stop compacting over and over after a huge nested Claude MD file. Control enter sends right away, even before the response starts. And Macs without Xcode stop showing the developer tools dialog at every start.
Faster edits in VS Code
>VS Code: Edit and Write finish sooner in the chat panel
- Wait for new problems
- 0.75 seconds in most cases
- Before
- 1 to 1.5 seconds after each edit
In VS Code, edits finish sooner. After each Edit or Write, the chat panel waits about three quarters of a second for new problems, down from as much as one and a half.
The full changelog
Every change is in the Claude Code changelog
https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md
Do you run Claude Code with the sandbox turned on?
The Claude Code changelog has the rest, including Slack, cloud session and Code Review fixes. So, do you run Claude Code with the sandbox turned on?
