DevAgentRadar → Claude Code

You are helping me adopt a real coding-assistant change. Work only from the facts below. Do not invent features.

Context

Assistant: Claude Code Proposal: Upgrade Claude Code to v2.1.309 so sandbox denyWrite, --mcp-config, and worktree isolation hold Summary: Upgrade to Claude Code v2.1.309. It closes sandbox startup-file, denyWrite symlink, --mcp-config, worktree-isolation, and Bash permission bypasses, and changes nested CLAUDE.md loading, /rewind for sed -i, ultrareview workspace trust, and split-pane --tools inheritance. Primary source: https://github.com/anthropics/claude-code/releases/tag/v2.1.309

Why it matters

v2.1.309 is a security-heavy patch, not a feature drop. On macOS and Linux, sandboxed Bash ran the shell's startup files outside the sandbox before each command. macOS denyWrite globs missed a path's real location when the pattern folder was reached through a symlink. Sandboxed commands and auto-accepted edits could modify the file passed with --mcp-config, and a disabled MCP server could be reconnected by a later permission prompt in print and SDK sessions. Bash permission checks trusted a variable set by a command whose redirect failed to open, skipped prompts for some wrapped or prefixed cd-then-git compounds, and missed an Edit(path) deny versus a Bash redirect that also held a subshell. Worktree-isolated sessions accepted some locale-prefixed commands and, on zsh, some arithmetic commands they should refuse. Linux sandbox write denies could lift when a background command outlived the session; Windows PowerShell auto-approved some Set-Location/cd targeting the current directory with extra arguments. Profile-store write protection also failed when the config directory was reached through a symlink. After you upgrade, match the intentional behavior shifts: nested CLAUDE.md over the size limit now loads only its start; split-pane teammates inherit the leader's tool deny and --tools; claude ultrareview requires workspace trust; sed -i is a real Bash edit and is not restored by /rewind. Do not assume anything from the 46 omitted changes.

Suggested actions

1. Upgrade this machine to Claude Code v2.1.309 and confirm claude --version reports 2.1.309 before the next sandboxed Bash, --mcp-config, or worktree-isolated session.
2. Keep passing --mcp-config for isolated MCP settings: v2.1.309 blocks sandboxed commands and auto-accepted edits from modifying that file. Leave disabled MCP servers disabled—later permission prompts in print and SDK sessions no longer reconnect them.
3. Move required instructions in any nested CLAUDE.md that exceeds the size limit to the very start of that file; v2.1.309 now loads only the start so sessions stop compacting repeatedly after reading huge nested CLAUDE.md trees.
4. Put --tools and tool deny rules on the leader Claude Code command line for split-pane agent teammates; they now inherit those restrictions instead of running without them.
5. For unattended ultrareview, put the PR number or base branch first, then --trust-workspace with no value (claude ultrareview <pr-or-base> --trust-workspace), or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1. Do not use /rewind to undo sed -i; those now run as real Bash edits and are not restored.

Config surfaces this release may change

• permission rules (high confidence) — check your repo before applying
• background and headless runs (high confidence) — check your repo before applying
• subagent definitions (high confidence) — check your repo before applying
• skills (high confidence) — check your repo before applying
• sandbox settings — check your repo before applying
• MCP servers — check your repo before applying
• agent context files — check your repo before applying
• slash commands — check your repo before applying
• hooks — check your repo before applying

After you finish

Do not report this as applied to DevAgentRadar. You cannot write the visitor's loop.

Tell the human: open https://devagentradar.com/proposals/claude-code-v2-1-309-upgrade-claude-code-to-v2-1-309-so-sandbox-denywrit and mark Applied, Skipped, or Failed. Proposal id: 5cde0b90-4a6b-4826-ae2f-11e1fd52da03

Your job

1. Restate the change in one sentence.
2. Propose a minimal plan for my repo (or a throwaway pilot).
3. Implement only what I approve; prefer small diffs and tests.
4. Call out risks (permissions, breaking APIs, cost).

Start by confirming you understood the proposal.