What
When REPL sandbox code renders a global non-configurable (making it impossible to restore to a clean state), Claude Code now detects this, resets the VM context automatically, and shows a clear recovery message.
Details
- A new
VMContextPoisonedErrorclass is thrown when this condition is detected. - The REPL context is reset and the user sees: "REPL context poisoned by non-configurable global; context reset" with a note that "global state (variables, registered tools) starts fresh."
- Uses a WeakSet to identify boundary cap errors — the set is identity-based and not inspectable by attacker code, so a Proxy cannot fake a cap error to escape the walker.
Evidence
New error class (search for "REPL sandbox code made the global" or "VMContextPoisonedError")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.