Claude Code 2.1.309 fixes sandbox, MCP-config, and worktree isolation issues

Anthropic has released Claude Code 2.1.309, a security- and isolation-focused update. On macOS and Linux, the release fixes Bash running shell startup files outside the sandbox before each command. On macOS, denyWrite glob rules now also apply when a matching path's real location is reached through a symlink.

The update prevents sandboxed commands and auto-accepted edits from modifying the MCP configuration file supplied with --mcp-config. It also fixes a disabled MCP server being reconnected by a later permission prompt in print and SDK sessions, alongside several missed Bash permission checks: a variable trusted despite a redirect that could fail to open, wrapped or prefixed cd plus git compound commands that did not prompt, and an Edit(path) deny rule that did not block a Bash redirect in some commands using a subshell.

Teams using worktree isolation should also note fixes for some locale-prefixed commands and zsh arithmetic commands that the isolation guard incorrectly allowed. Anthropic also says worktrees and branch checkouts that Claude Code creates now ignore git replace refs, matching its other Git operations.

Upgrade first in a non-production workspace. Test automations that pass --mcp-config, write denials through symlinks, Bash approval policies, and worktree tasks. These changes narrow bypasses of existing boundaries, but do not replace least-privilege configuration, code review, or secret isolation.

Related catalog entry